111 matches found
CVE-2026-11417-AWS-CDK-RCE
Supply Chain Command Injection in AWS CDK's NodejsFunction CVE-2026-11417 Author: Hesham Ashraf @HeshamASH Date: June 10, 2026 Severity: High CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command OS Command Injection Affected Package: aws-cdk-l...
CVE-2026-115418
SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...
EUVD-2026-109988
SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...
CVE-2026-115418
SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...
PT-2026-123426
Name of the Vulnerable Software and Affected Versions @aws-cdk/aws-redshift-alpha versions prior to 2.274.0-alpha.0 Description SQL injection exists in the database-query custom resource handlers. A third party capable of influencing construct property values can execute SQL statements with Amazo...
@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +631 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0-alpha.4, <=2.266.0)
aws-cdk-lib NPM version =2.0.0-alpha.4, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-107608 Source advisory:...
Symlink Attack
Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Symlink Attack in the asset bundling output handling, which accepts a symbolic link that the Docker build placed in the output directory even though no such link was...
CVE-2026-107608
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
CVE-2026-107608
The aws-cdk-lib library, versions prior to 2.267.0 , is vulnerable to improper link resolution (CWE-59) during asset bundling output handling. This flaw occurs because the system fails to properly resolve links before accessing files, potentially allowing a context-dependent actor to cause files ...
EUVD-2026-95252
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
CVE-2026-107608
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
apus-cli (0.0.21), asaas-cdk-constructs (0.1.0) +183 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0, <=2.260.0)
aws-cdk-lib PYPI version =2.0.0, =0.0.1, =0.0.3, =2.6.4, =2.82.0a0, =0.0.0, =2.73.0a0, =2.73.0a0, =2.73.0a0, =2.73.0a0, =2.91.0a0, =2.73.0a0, =2.73.0a0, =2.95.1a0 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-107608...
CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +630 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0-rc.4, <=2.266.0)
aws-cdk-lib NPM version =2.0.0-rc.4, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-10760...
PT-2026-108194
Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.267.0 Description Improper link resolution before file access in the asset bundling output handling allows a context-dependent actor to cause files from the build host to be published as the deployed asset...
CVE-2026-107608: Improper Link Resolution Before File Access
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...
