Skip to content
OpenAdvisories

Package · npm

aws-cdk-lib

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Low 3.3
    GHSA-464c-974j-9xm6

    AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

    ## Summary The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting `encrypted: true` …

    aws-cdk-lib aws-cdk-lib Amazon.CDK.Lib github.com/aws/aws-cdk-go/awscdk/v2 npm Maven PyPI Go NuGet
  • High 7.3
    CVE-2026-13760

    OS Command Injection in aws-cdk-lib Docker Bundling

    OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host r…

    AWS AWS CDK aws-cdk-lib npm
  • High 7.3
    CVE-2026-11417 Public exploit

    OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

    OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to e…

    AWS AWS Cloud Development Kit library aws-cdk-lib npm
  • Low 2.2
    GHSA-qc59-cxj2-c2w4

    aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role

    ### Summary The [AWS Cloud Development Kit (AWS CDK)](https://aws.amazon.com/cdk/) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. In the CDK, developers organize their…

    aws-cdk-lib npm
  • Medium 6.5
    GHSA-qq4x-c6h6-rfxh

    aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct

    ### Summary The [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates duri…

    aws-cdk-lib npm
  • Low 3.8
    GHSA-5pq3-h73f-66hr

    AWS CDK CodePipeline: trusted entities are too broad

    ### Summary The [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during …

    aws-cdk-lib npm
  • Low 1.8
    CVE-2025-23206

    IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk

    The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints a…

    AWS AWS CDK aws-cdk-lib npm
  • Medium 6.6
    CVE-2023-35165

    AWS CDK EKS overly permissive trust policies

    AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202…

    AWS AWS CDK aws-cdk-lib @aws-cdk/aws-eks npm