Executive brief
AWS jsii-diff is a tool used by developers to compare different versions of JSII libraries for breaking changes. A vulnerability in how it handles package loading could allow an attacker to execute unauthorized commands on a developer's machine if they are tricked into processing a specially crafted package. This could lead to a full system compromise, data theft, or unauthorized access to development environments.
Technical details
An OS command injection vulnerability exists in the npm package loading component of AWS jsii-diff before version 1.131.0. The flaw is located in the handling of the 'npm:' source argument, where externally-influenced package specifiers are insufficiently neutralized before being used to construct OS commands (CWE-78). An attacker can achieve arbitrary code execution in the context of the application by providing a malicious package specifier. Exploitation requires local access and user interaction (processing the malicious input). The issue is resolved in version 1.131.0.
Affected products
- AWS jsii-diff < 1.131.0
Timeline
- 2026-07-15: disclosed
- 2026-07-15: advisory
- 2026-08-07: other: Advisory withdrawn as duplicate of GHSA-wcx4-wpfv-mc5c