Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-11417 EUVD-2026-36076GHSA-999r-qq7v-r334

OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

Published Jun 10, 2026 · Updated Jun 10, 2026 · Assigned by AMZN

Vendor: AWS Product: AWS Cloud Development Kit library Package: aws-cdk-lib Ecosystem: npm

Description

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

Affected products

VendorProductAffectedFixed
AWS AWS Cloud Development Kit library < 2.245.0 2.245.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • HeshamASH/CVE-2026-11417-AWS-CDK-RCE ★ 0 · Jun 13, 2026

    Technical writeup and Proof of Concept (PoC) for CVE-2026-11417: OS Command Injection / Remote Code Execution (RCE) in AWS CDK's NodejsFunction.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm aws-cdk-lib < 2.246.0 2.246.0 GHSA-999r-qq7v-r334

References