An issue exists in the Amazon Redshift JDBC Driver that allows it to load and execute arbitrary classes when parsing JDBC connection URL parameters. When an attacker can influence the connection URL, they can specify a class name that is present on the application's classpath, resulting in code execution within the application’s process. This achieves complete remote code execution and is rooted in unsafe class loading (CWE‑470). The impact is high because the code runs with the application’s privileges, potentially allowing data tampering, persistence, or further lateral movement.

Versions of the Amazon Redshift JDBC Driver published before 2.2.2 on any supported platform are affected. Users who have not updated to 2.2.2 or later remain at risk.

The CVSS score of 9.2 indicates critical severity. No EPSS data is available, but the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to alter the JDBC connection URL and for a suitable class to already exist on the classpath. In environments where applications construct URLs from untrusted input, the risk of exploitation is high. The attack vector is essentially remote code execution via manipulation of a JDBC connection string.