86 matches found
CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...
CVE-2026-108096
The AWS Amplify API Category contains an improper authorization vulnerability in the query resolvers generated by the @aws-amplify/graphql-index-transformer component. This flaw exists in versions prior to 3.1.2 and allows an authenticated remote user to read records owned by other users within t...
PT-2026-109295
Name of the Vulnerable Software and Affected Versions @aws-amplify/graphql-index-transformer versions prior to 3.1.2 Description Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category may allow an authenticated remote user to...
EUVD-2025-13500
AWS Amplify Studio UI Component Properties Has an Input Validation Issue...
@aws-amplify/amplify-util-uibuilder (>=1.2.13-studio-q1-release.0, <=1.14.27), @aws-amplify/cli (>=7.6.11-beta.0, <=7.6.26) +4 more potentially affected by CVE-2025-4318 via @aws-amplify/codegen-ui-react (>=2.1.0, <=2.14.2)
@aws-amplify/codegen-ui-react NPM version =2.1.0, =1.2.13-studio-q1-release.0, =7.6.11-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2025-4318 Source advisory: OSV:GHSA-HF3J-86P7-MFW8...
AWS Amplify Studio UI Component Properties Has an Input Validation Issue
Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...
GHSA-HF3J-86P7-MFW8 AWS Amplify Studio UI Component Properties Has an Input Validation Issue
Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...
@aws-amplify/amplify-util-uibuilder (>=1.2.13-studio-q1-release.0, <=1.14.27), @aws-amplify/cli (>=7.6.11-beta.0, <=7.6.26) +4 more potentially affected by CVE-2026-18245 via @aws-amplify/codegen-ui-react (>=2.1.0, <=2.14.2)
@aws-amplify/codegen-ui-react NPM version =2.1.0, =1.2.13-studio-q1-release.0, =7.6.11-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =0.1.0-alpha.0, =0.1.0-next.0 - edilkamin 0.0.1 Source cves: CVE-2026-18245 Source advisory: SNYK:JS-AWSAMPLIFYCODEGENUIREACT-18601829...
CVE-2026-18245
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
CVE-2026-18245
The CVE-2026-18245 entry concerns Amazon @aws-amplify/codegen-ui-react before 2.20.6, where the incomplete fix for CVE-2025-4318 leaves input validation insufficient. This may allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments,...
CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
CVE-2026-18245
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
EUVD-2026-51268
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
CVE-2026-18245: Improper Control of Generation of Code
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...
@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @abletest/able (>=0.0.1, <=0.0.4) +274 more potentially affected by unknown CVE via @aws-cdk/aws-codebuild (>=1.75.0, <=1.204.0)
@aws-cdk/aws-codebuild NPM version =1.75.0, =1.0.0, =0.0.1, =0.1.0, =1.0.6, =1.0.0, =1.1.0-GqlExtensibility.1, =1.2.0-geo.0, =0.0.1, =4.13.3-beta.0, =7.6.26-npm-pkg-cli.0, =7.6.27-alpha.5030, =1.1.0-ext1.0, =1.75.0, =1.0.0, =1.204.0 and more Source cves: unknown CVE Source advisory:...
Malicious code in @amplify-js/datastore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a31c933f191cd94be3e10adb951ed57652fe41955589d37ce8c200c96256f36e The package @amplify-js/datastore was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview @amplify-js/datastore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-2574 Malicious code in @amplify-js/datastore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a31c933f191cd94be3e10adb951ed57652fe41955589d37ce8c200c96256f36e The package @amplify-js/datastore was found to contain malicious code. Source: ghsa-malware...
