CVE-2025-4318
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. An authenticated user with access to create or modify components can inject arbitrary JavaScript code.
Risk Assessment
An attacker can execute malicious JavaScript during component rendering, potentially leading to data theft, session hijacking, or other client-side attacks.
Recommendation
Update the aws-amplify/amplify-codegen-ui package to a version that includes input validation fixes.
Original NVD description (English source)
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.