Executive brief
AWS jsii is a framework for defining cloud infrastructure using TypeScript. The jsii-diff tool, used to compare infrastructure definitions, contains a command injection vulnerability that allows attackers to execute arbitrary system commands. An attacker exploiting this flaw could gain code execution and potentially compromise systems using jsii for infrastructure as code, leading to unauthorized access to cloud resources and configuration data.
Technical details
This vulnerability is a classic OS command injection flaw located in the jsii-diff component of AWS jsii. The vulnerability stems from insufficient input sanitization when processing command-line arguments or file inputs passed to system commands. An attacker with the ability to provide input to jsii-diff (e.g., via a specially crafted diff file or command-line parameter) can inject shell metacharacters to execute arbitrary commands. The attack requires the attacker to have the ability to invoke jsii-diff with malicious input, which could occur in CI/CD pipelines, local development environments, or infrastructure deployment workflows. Exploitation results in arbitrary code execution with the privileges of the jsii process. AWS has published a security bulletin addressing this issue; users should update to patched versions as recommended.
Affected products
- AWS jsii <UNKNOWN>
Timeline
- 2026-09-22: disclosed