CVE-2026-11417 json
OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
published 4mo ago modified 14d ago also GHSA-999r-qq7v-r334 , EUVD-2026-36076
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.
To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
Patch / fix
- npm aws-cdk-lib 2.246.0
- AWS AWS Cloud Development Kit library 2.245.0
- github.com/aws/aws-cdk#37292 pull request
- github.com/aws/aws-cdk#37412 pull request
- github.com/aws/aws-cdk/releases/tag/v2.245.0 release
Is CVE-2026-11417 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4mo ago
Exploit prediction
0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.0 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | aws-cdk-lib | <2.246.0 |
2.246.0 |
Affected products
- AWS AWS Cloud Development Kit library
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/aws/aws-cdk/releases/tag/v2.245.0
patch, web
-
github.com
/aws/aws-cdk/pull/37292
web
-
github.com
/aws/aws-cdk/pull/37412
web
-
aws.amazon.com
/security/security-bulletins/2026-041-aws/
vendor-advisory
-
github.com
/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-11417
advisory
-
aws.amazon.com
/security/security-bulletins/2026-041-aws
web
-
github.com
/aws/aws-cdk
package
Sources
- CVE List CVE-2026-11417
- GitHub Advisory GHSA-999r-qq7v-r334
- NVD CVE-2026-11417
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.