CVE-2026-11417: high-severity vulnerability in AWS Cloud Development Kit library
OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. It has a public proof of concept.
A vulnerability in AWS CDK's NodeJS bundling tool allows someone who can control certain bundling settings to run malicious commands on your computer when you build your application. This is dangerous because it gives attackers access to your system and sensitive data.
OS command injection via unsanitized bundling properties (externalModules, define, loader, inject, esbuildArgs) in NodejsFunction local bundling pipeline. Attack vector requires threat actor to control CDK application configuration; malicious shell metacharacters in affected properties are passed unsafely to shell execution during build time. Impact includes arbitrary command execution on the host running CDK toolchain with privileges of the CDK process.