CVE-2026-18245

The record

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6

Affected packages

Related vulnerabilities

• CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-94
• CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63345 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
• CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-94
• CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-94
• CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. CWE-94
• CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory… CWE-94