Executive brief
Amazon Amplify Codegen UI is a library used to automatically generate React components and themes for web applications. A security vulnerability exists where a user with access to the design studio could provide malicious data that causes the library to generate and execute unauthorized code. This could lead to a full compromise of developer machines, automated build systems (CI/CD), and the browsers of people visiting the affected website.
Technical details
A code injection vulnerability (CWE-94) exists in @aws-amplify/codegen-ui-react due to an incomplete fix for a previous vulnerability (CVE-2025-4318). The library fails to properly neutralize special elements in component or theme schema values during the React code generation process. An authenticated attacker can provide a crafted schema that, when processed, executes arbitrary JavaScript in various environments including developer workstations, CI/CD pipelines, and server-side rendering (SSR) contexts. The vulnerability is triggered when the generated code is rendered or built, requiring some level of user interaction. The issue is resolved in version 2.20.6 by ensuring non-identifier theme keys are emitted as string literals.
Affected products
- Amazon @aws-amplify/codegen-ui-react < 2.20.6
Timeline
- 2026-07-14: patched: Version 2.20.6 released
- 2026-07-30: disclosed: Public advisory published