CVE-2026-11417

HighCVSS 7.3

Published: 10/06/2026(UTC)Updated: 10/06/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.03%

10th percentile - higher than 10% of all known CVEs

Summary

In aws-cdk-lib before version 2.245.0 (2.246.0 on Windows), there is an OS command injection vulnerability in the NodejsFunction local bundling pipeline. An attacker controlling the value of one or more bundling properties can execute arbitrary commands on the host running the CDK toolchain.

Risk Assessment

This vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious threat to the organization's security.

Recommendation

It is recommended to upgrade to aws-cdk-lib version 2.245.0 (2.246.0 on Windows) or later to mitigate this vulnerability.

Other vulnerabilities in aws-cdk-lib

CVE-2026-13760High
OS command injection vulnerability in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib. An attacker controlling dependency version strings in package.json can execute arbitrary commands on the CDK toolchain host via injected shell metacharacters.

Original NVD description (English source)

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application. To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.