CVE-2026-18245
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In @aws-amplify/codegen-ui-react before version 2.20.6, improper control of code generation might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values. This is due to insufficient coverage and effectiveness of input validation introduced for CVE-2025-4318.
Risk Assessment
An attacker can remotely execute arbitrary code in multiple contexts, potentially leading to account takeover, data theft, or compromise of development and production environments.
Recommendation
Update @aws-amplify/codegen-ui-react to version 2.20.6 or later.
Original NVD description (English source)
Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6