@aws-amplify/amplify-util-uibuilder (>=1.2.13-studio-q1-release.0, <=1.14.27), @aws-amplify/cli (>=7.6.11-beta.0, <=7.6.26) +4 more potentially affected by CVE-2025-4318 via @aws-amplify/codegen-ui-react (>=2.1.0, <=2.14.2)

@aws-amplify/codegen-ui-react NPM version =2.1.0, =1.2.13-studio-q1-release.0, =7.6.11-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2025-4318 Source advisory: GHSA-HF3J-86P7-MFW8...

CVE-2026-18245: Improper Control of Generation of Code

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

@aws-amplify/amplify-util-uibuilder (>=1.1.2-beta.1, <=1.14.27), @aws-amplify/cli (>=7.6.2-beta.1, <=7.7.0-flutter-preview.2) +4 more potentially affected by CVE-2025-4318 via @aws-amplify/codegen-ui-react (>=1.2.0, <=2.14.2)

@aws-amplify/codegen-ui-react NPM version =1.2.0, =1.1.2-beta.1, =7.6.2-beta.1, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2025-4318 Source advisory: MEND:CVE-2025-4318...