Critical · 9.0 CVE-2025-4318 EUVD-2025-13500GHSA-hf3j-86p7-mfw8

Input validation issue in AWS Amplify Studio UI component properties

Published May 5, 2025 · Updated Jul 29, 2026 · Assigned by AMZN

Vendor: amazon Product: Amplify Studio Package: @aws-amplify/codegen-ui-react Ecosystem: npm

Description

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

Affected products

Vendor	Product	Affected	Fixed
Amazon	Amplify Studio	0.1.0 – < 2.20.3	2.20.3

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	@aws-amplify/codegen-ui-react	< 2.20.3	2.20.3	GHSA-hf3j-86p7-mfw8

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-010/ vendor-advisory
https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3 patch
https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8 vendor-advisory