Executive brief
projen is an open-source infrastructure-as-code tool used by developers to define and synthesize project configurations. A flaw in its file cleanup logic allows attackers to craft malicious project configuration files that trick the tool into recursively deleting files and directories outside the intended project directory, potentially destroying important user data when developers run the tool on a compromised project.
Technical details
CVE-2026-89065 is a path traversal vulnerability in projen's file manifest cleanup component. The vulnerability stems from insufficient validation of file paths in the version-controlled generated file manifest (.projen/files.json) that is consumed during project synthesis. An attacker can craft malicious entries using relative path sequences (e.g., ../../../) in this manifest to escape the project directory and delete arbitrary files on the developer's workstation or CI/CD runner. The attack is context-dependent, requiring the victim to clone or run the malicious project. The corrected containment check is automatically applied by the projen runtime on the next execution. Mitigation involves upgrading to projen version 0.101.37 or later.
Affected products
- AWS projen before 0.101.37
CVE identifiers
- CVE-2026-89066
- CVE-2026-89065
Timeline
- 2026-09-11: disclosed