Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 15 April 2025.

Which products and versions are affected?

AWS CDK 2.172.0 to 2.189.0; aws-cdk-lib (npm) SEMVER:introduced=2.172.0,fixed=2.189.1.

Is there a fix for This vulnerability?

Yes. aws-cdk-lib (npm): upgrade to 2.189.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run AWS CDK or aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

AWS CDK permissions boundary aspect ordering vulnerability

Severity: low · CVSS 3.1 · Published 2025-04-15

AWS CDK is a framework developers use to define cloud infrastructure in code. A change in version 2.172.0 altered the order in which configuration rules ("aspects") are applied to cloud resources. This can cause role permissions boundaries to be set incorrectly, potentially granting roles insufficient or unintended permissions. Applications running affected versions may have deployed infrastructure with incorrect security controls.

Technologies: AWS CDK, aws-cdk-lib (npm). Vendors: AWS, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 15 April 2025.
Which products and versions are affected?: AWS CDK 2.172.0 to 2.189.0; aws-cdk-lib (npm) SEMVER:introduced=2.172.0,fixed=2.189.1.
Is there a fix for This vulnerability?: Yes. aws-cdk-lib (npm): upgrade to 2.189.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run AWS CDK or aws-cdk-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

aws-cdk-lib (npm): upgrade to 2.189.1 or later
```
npm install aws-cdk-lib@2.189.1
```

Technical details

This vulnerability is a logic error in aspect prioritization introduced in AWS CDK 2.172.0. The root cause is a new priority system that takes precedence over hierarchical location for aspect execution order. User-defined aspects are assigned DEFAULT priority (500) while CDK-internal aspects receive MUTATING priority (200), causing user aspects to execute last and override CDK-internal overrides. An attacker with the ability to define custom aspects or control CDK application code could craft a malicious aspect to apply overly permissive or restrictive permissions boundaries to IAM roles. The vulnerability requires high privilege and complexity to exploit. The issue is fixed in version 2.189.1 with a feature flag to restore legacy behavior.

Affected products

AWS CDK 2.172.0 to 2.189.0

Timeline

2025-04-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.