PT-2026-60262 · Aws · Jsii

Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-15895

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.

To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-15895

Affected Products

Jsii

References · 3

• https://github.com/aws/jsii/releases/tag/v1.131.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-15895 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-057-aws · Vendor Advisory