CVE-2026-11417CWE-78

OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

High · published June 10, 2026

CVSS v4.0
7.0
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00993 · 62.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-10T17:39Z
EPSS history
Timeline
  • 10 JUN 17:39Z
    OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
    cvelistv5