PT-2026-48489 · Aws · Aws Cloud Development Kit Library

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-11417

NVD

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-11417

Affected Products

Aws Cloud Development Kit Library

References · 4

• https://github.com/aws/aws-cdk/releases/tag/v2.245.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11417 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-041-aws · Vendor Advisory
• https://github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334 · Note