PT-2025-19763 · Aws · Aws-Amplify/Amplify-Codegen-Ui

Ray The Bounty Hunter · Published 2025-05-05 · Updated 2026-01-28 · CVE-2025-4318

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions aws-amplify/amplify-codegen-ui (affected versions not specified)

Description The issue is related to a lack of input validation in the AWS Amplify Studio UI component property expressions. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-4318

GHSA-HF3J-86P7-MFW8

Affected Products

Aws-Amplify/Amplify-Codegen-Ui

References · 27

• 🔥 https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce · Exploit
• https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3 · Patch
• https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4318 · Security Note
• https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6 · Note
• https://t.me/cveNotify/150205 · Telegram Post
• https://twitter.com/dailytechonx/status/1920195680221737165 · Twitter Post
• https://twitter.com/cybercronai/status/1920075008031748193 · Twitter Post
• https://twitter.com/CCBalert/status/1919753080008052785 · Twitter Post
• https://t.me/true_secator/7125 · Telegram Post
• https://t.me/cvenotify/129472 · Telegram Post
• https://twitter.com/syedaquib77/status/1920170709474816502 · Twitter Post
• https://twitter.com/fletch_ai/status/1920388258095378712 · Twitter Post