CVE-2026-119085

The record

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

Affected packages

Related vulnerabilities

• CVE-2026-39379 GeoNetwork is a catalog application to manage spatially referenced resources. CWE-1336
• CVE-2026-44267 Elo is a purely functional expression language for no-code tools. CWE-1336
• CVE-2026-44266 Elo is a purely functional expression language for no-code tools. CWE-1336
• CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-1336
• CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template… CWE-1336
• CVE-2026-118803 Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection… CWE-1336