OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

A vulnerability in AWS CDK's NodeJS bundling tool allows someone who can control certain bundling settings to run malicious commands on your computer when you build your application. This is dangerous because it gives attackers access to your system and sensitive data.

OS command injection via unsanitized bundling properties (externalModules, define, loader, inject, esbuildArgs) in NodejsFunction local bundling pipeline. Attack vector requires threat actor to control CDK application configuration; malicious shell metacharacters in affected properties are passed unsafely to shell execution during build time. Impact includes arbitrary command execution on the host running CDK toolchain with privileges of the CDK process.