@aws-cdk/integ-runner (>=2.172.0-alpha.0, <=2.178.1-alpha.0), @bifravst/http-api-mock (>=2.1.97, <=2.1.144) +4 more potentially affected by CVE-2025-2598 via aws-cdk (>=2.172.0, <=2.178.1)

aws-cdk NPM version =2.172.0, =2.172.0-alpha.0, =2.1.97, =4.3.190, =3.2.25, =2.172.0, =2.178.1 Source cves: CVE-2025-2598 Source advisory: OSV:GHSA-V63M-X9R9-8GQP...

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

Summary The AWS Cloud Development Kit AWS CDK 1 is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. The AWS CDK CLI 2 is a command line tool for interacting with CDK applications. Customers can use the CDK CLI ...

@bifravst/http-api-mock (>=2.1.97, <=2.1.144), @iehr/cdk (>=4.3.190, <=4.3.201) +1 more potentially affected by CVE-2025-2598 via cdk (>=2.172.0, <=2.178.1)

cdk NPM version =2.172.0, =2.1.97, =4.3.190, =3.2.25, =4.0.1 Source cves: CVE-2025-2598 Source advisory: OSV:GHSA-V63M-X9R9-8GQP...

CVE-2025-2598

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

CVE-2025-2598

CVE-2025-2598 (AWS CDK CLI) : When using the AWS CDK CLI with a credential plugin that returns an expiration property, credentials may be printed to console output. The issue is mitigated by upgrading to version 2.178.2 or later and patching any forked/derivative code. Public references indicate ...

CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

CVE-2024-7884

When a canister method is called via iccdk::call , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

GHSA-V4MQ-X674-FF73 AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +407 more potentially affected by CVE-2025-23206 via aws-cdk-lib (>=2.0.0, <=2.176.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.0.0-ampgenconfig.0, =3.1.25 and more Source cves: CVE-2025-23206 Source advisory:...

CVE-2025-23206

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...

THN Cybersecurity Recap: Top Threats, Tools and News (Oct 21 - Oct 27)

Cybersecurity news can sometimes feel like a never-ending horror movie, can't it? Just when you think the villains are locked up, a new threat emerges from the shadows. This week is no exception, with tales of exploited flaws, international espionage, and AI shenanigans that could make your head...

MAL-2024-9186 Malicious code in sp-api-app-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13c1afd5646e2a56f333e462e72e1410090f84341d7c0c542598ef4a3061a180 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview sp-api-app-cdk is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...

CVE-2024-7884 Memory leak when calling a canister method via `ic_cdk::call`

When a canister method is called via iccdk::call , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

@aws-cdk/integ-runner (>=2.142.0-alpha.0, <=2.148.0-alpha.0), @jill64/sveltekit-adapter-aws (>=1.9.3, <=1.9.45) +3 more potentially affected by CVE-2024-45037 via aws-cdk (>=2.142.0, <=2.148.0)

aws-cdk NPM version =2.142.0, =2.142.0-alpha.0, =1.9.3, =3.1.6, =2.142.0, =2.148.0 Source cves: CVE-2024-45037 Source advisory: OSV:GHSA-QJ85-69XF-2VXQ...

AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template

Summary The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built component...

CVE-2024-45037

The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called...