OS Command Injection NodejsFunction bundling in aws-cdk-lib <2.245.0
CVE-2026-11417 Published on June 10, 2026
OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.
To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
Vulnerability Analysis
CVE-2026-11417 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-11417 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-11417
stack.watch emails you whenever new vulnerabilities are published in Aws Cloud Development Kit Library or Amazon Aws. Just hit a watch button to start following.
Affected Versions
AWS Cloud Development Kit library:- Before 2.245.0 is affected.