This vulnerability (CVE-2026-5485) involves improper neutralization of special elements used in OS commands (CWE-78) within the Amazon Athena ODBC driver's browser-based authentication on Linux. A local attacker can exploit this by providing malicious connection parameters, leading to arbitrary code execution. The issue affects versions prior to 2.0.5.1. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local user to execute arbitrary code on the affected system, potentially compromising confidentiality, integrity, and availability of the system running the vulnerable Amazon Athena ODBC driver. This could lead to unauthorized actions or system compromise under the privileges of the user initiating the connection.

Users should upgrade the Amazon Athena ODBC driver to version 2.0.5.1 or later, as this version addresses the vulnerability. Since the vendor advisory is available, it is recommended to follow the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-013-aws/ for detailed remediation instructions. Patch status is not explicitly stated in the input but the advisory and upgrade recommendation indicate an official fix is available.