CWE-89 SQL Injection potential

[Steven-Beasley]

aws-secrets-manager-rotation-lambdas/SecretsManagerRDSMariaDBRotationMultiUser/lambda_function.py

Line 207 in b4b8eca

cur.execute(new_grant_escaped + " TO %s IDENTIFIED BY %s", (pending_dict['username'], pending_dict['password']))

This should be properly parameterized.