Executive brief
The AWS Cloud Development Kit (CDK), a tool used by developers to define cloud infrastructure using code, contains a security flaw in its Node.js function bundling process. If a developer uses untrusted configuration values or third-party components, an attacker could execute malicious commands on the developer's computer or build server. This could lead to the theft of sensitive credentials, unauthorized access to cloud environments, or full system compromise during the infrastructure deployment process.
Technical details
An OS command injection vulnerability exists in the `NodejsFunction` component of `aws-cdk-lib`. The root cause is the improper neutralization of shell metacharacters within bundling properties such as `externalModules`, `define`, `loader`, `inject`, and `esbuildArgs`. These values were interpolated into a command string and executed via a shell (`bash -c` or `cmd /c`) using `spawnSync`. An attacker who can control these properties—for example, through a malicious pull request or a compromised upstream dependency—can achieve arbitrary code execution with the privileges of the user running `cdk synth`, `cdk deploy`, or `cdk diff`. The vulnerability is fixed in version 2.245.0 (and 2.246.0 for Windows) by switching to array-based `spawnSync` calls that bypass shell interpretation.
Affected products
- AWS aws-cdk-lib < 2.245.0 (Linux/macOS), < 2.246.0 (Windows)
Timeline
- 2026-06-10: disclosed
- 2026-06-10: patched: Initial fix in 2.245.0; Windows regression fix in 2.246.0
- 2026-06-15: advisory