CDK

CDK - Zero Dependency Container Penetration Toolkit English | 简体中文 Legal Disclaimer Usage of CDK for attacking targets without prior mutual consent is illegal. CDK is for security testing purposes only. Overview CDK is an open-sourced container penetration toolkit, designed for offering stable...

CVE-2026-11417-AWS-CDK-RCE

Supply Chain Command Injection in AWS CDK's NodejsFunction CVE-2026-11417 Author: Hesham Ashraf @HeshamASH Date: June 10, 2026 Severity: High CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command OS Command Injection Affected Package: aws-cdk-l...

CVE-2026-115418

SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...

EUVD-2026-109988

SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...

CVE-2026-115418

A SQL injection vulnerability exists in the database-query custom resource handlers within the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module. This flaw affects versions prior to 2.274.0-alpha.0 . An attacker capable of influencing construct property valu...

CVE-2026-115418

SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...

CVE-2026-115418 SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha

SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...

PT-2026-123426

Name of the Vulnerable Software and Affected Versions @aws-cdk/aws-redshift-alpha versions prior to 2.274.0-alpha.0 Description SQL injection exists in the database-query custom resource handlers. A third party capable of influencing construct property values can execute SQL statements with Amazo...

CLSA-2026-1792161726 TuxCare security update for @medplum/cdk (1 CVE)

TuxCare rebuilt @medplum/cdk to address 1 CVE. Fixed in 3.3.1-tuxcare.2...

PT-2026-124263

TuxCare rebuilt @medplum/cdk to address 1 CVE. Fixed in 3.3.1-tuxcare.2...

@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) +2 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-api-construct (>=1.4.0, <=1.20.2)

@aws-amplify/graphql-api-construct NPM version =1.4.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =1.4.0, =1.0.0, =1.1.111 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +631 more potentially affected by CVE-2026-107608 via aws-cdk-lib (>=2.0.0-alpha.4, <=2.266.0)

aws-cdk-lib NPM version =2.0.0-alpha.4, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-107608 Source advisory:...

Symlink Attack

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Symlink Attack in the asset bundling output handling, which accepts a symbolic link that the Docker build placed in the output directory even though no such link was...

CVE-2026-107608

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

CVE-2026-107608

The aws-cdk-lib library, versions prior to 2.267.0 , is vulnerable to improper link resolution (CWE-59) during asset bundling output handling. This flaw occurs because the system fails to properly resolve links before accessing files, potentially allowing a context-dependent actor to cause files ...

EUVD-2026-95252

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

CVE-2026-107608

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

CVE-2026-107608 Improper link resolution in asset bundling output handling in aws-cdk-lib

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

cloud.pianola:cdk-fluent-assertions (>=1.0.0, <=1.0.1), com.cloudcamphq:aws-runtime (0.0.1) +781 more potentially affected by CVE-2026-107608 via software.amazon.awscdk:aws-cdk-lib (>=2.0.0-rc.27, <=2.266.0)

software.amazon.awscdk:aws-cdk-lib MAVEN version =2.0.0-rc.27, =1.0.0, =1.0.8, =1.0.8, =1.0.8, =1.0.8, =1.0.8, =2.0.0 and more Source cves: CVE-2026-107608 Source advisory: MEND:CVE-2026-107608...