CVE-2026-11417
Description
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.
To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
aws-cdk-libnpm | < 2.246.0 | 2.246.0 |
Affected products
2- Range: <2.245.0 (2.246.0 on Windows)
- Range: <2.245.0 (2.246.0 on Windows)
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-999r-qq7v-r334ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-11417ghsaADVISORY
- aws.amazon.com/security/security-bulletins/2026-041-awsghsaWEB
- github.com/aws/aws-cdk/pull/37292ghsaWEB
- github.com/aws/aws-cdk/pull/37412ghsaWEB
- github.com/aws/aws-cdk/releases/tag/v2.245.0nvdWEB
- github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334nvdWEB
- aws.amazon.com/security/security-bulletins/2026-041-aws/nvd
News mentions
0No linked articles in our index yet.