CVE-2026-11417

OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

State: Published
Severity: 7.0 High
Published: Jun 10, 2026
Updated: Jun 10, 2026
Reserved: Jun 5, 2026

Description

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	AMZN
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	AMZN

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command

Affected Products

Product	Versions
AWS Cloud Development Kit libraryAWS	before 2.245.0Affected

References

https://github.com/aws/aws-cdk/releases/tag/v2.245.0patch
https://aws.amazon.com/security/security-bulletins/2026-041-aws/vendor-advisory
https://github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.