CVE-2025-4318criticalCWE-95

CVE-2025-4318: critical vulnerability in Amazon Amplify Studio

Input validation issue in AWS Amplify Studio UI component properties

Published · Updated

Follow this CVE+ Monitor Amplify Studio+ Monitor @aws-amplify/codegen-ui-react

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9epss 1.0%
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Amazon · Amplify Studio
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.