CVE-2026-11417 json
OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
published 2026-06-10 4 mo ago modified 2026-10-26 14 d ago also GHSA-999r-qq7v-r334 , EUVD-2026-36076
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.
To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
Patch / fix
- npm aws-cdk-lib 2.246.0
- AWS AWS Cloud Development Kit library 2.245.0
- github.com/aws/aws-cdk#37292 pull request
- github.com/aws/aws-cdk#37412 pull request
- github.com/aws/aws-cdk/releases/tag/v2.245.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | aws-cdk-lib | <2.246.0 |
2.246.0 |
Affected products
- AWS AWS Cloud Development Kit library
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/aws/aws-cdk/releases/tag/v2.245.0
patch, web
-
github.com
/aws/aws-cdk/pull/37292
web
-
github.com
/aws/aws-cdk/pull/37412
web
-
aws.amazon.com
/security/security-bulletins/2026-041-aws/
vendor-advisory
-
github.com
/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-11417
advisory
-
aws.amazon.com
/security/security-bulletins/2026-041-aws
web
-
github.com
/aws/aws-cdk
package
Sources
- CVE List CVE-2026-11417
- GitHub Advisory GHSA-999r-qq7v-r334
- NVD CVE-2026-11417
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.