AIKIDO-2026-579479
nzpy is vulnerable to Remote Code Execution (RCE)
90
Critical Risk
This Affects:
nzpyTL;DR
The wire-protocol type decoder contained a critical RCE vulnerability by using eval() on server-controlled data. The fix removes/replaces the unsafe eval() logic in the vector_in() decoder (and drops the unsupported array_in() decoder), preventing attackers from injecting executable payloads via server responses.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and if your implementation is if connecting to untrusted Netezza servers or over unencrypted connections.
Background info
nzpy is vulnerable to Remote Code Execution (RCE) in versions 1.1 - 1.17.5.
How to fix this
Upgrade the nzpy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant