GHSA-999r-qq7v-r334
High · 7.3CVSS
7.3
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | aws-cdk-lib | 0 | 2.246.0 |
Related vulnerabilities
- CVE-2026-11417 OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before… Same vulnerability
- GHSA-qq4x-c6h6-rfxh aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using… Also affects aws-cdk-lib
- GHSA-5pq3-h73f-66hr AWS CDK CodePipeline: trusted entities are too broad Also affects aws-cdk-lib
- CVE-2025-23206 AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to… Also affects aws-cdk-lib
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78