CVE-2026-11417: OS Command Injection in AWS CDK NodejsFunction Bundling Pipeline

Vulnerability ID: CVE-2026-11417
CVSS Score: 7.3
Published: 2026-06-15

A critical supply-chain OS command injection vulnerability exists in the NodejsFunction local bundling pipeline within the AWS Cloud Development Kit (CDK) library (aws-cdk-lib) before version 2.245.0 (and before 2.246.0 on Windows systems). The vulnerability allows a threat actor who can control any of several bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary operating system commands on the host machine running the CDK compilation or deployment toolchain (e.g., during cdk synth, cdk deploy, or cdk diff).

TL;DR

Unsanitized input interpolation in the AWS CDK NodejsFunction bundling component allows unauthenticated local command execution during infrastructure synthesis (cdk synth).

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-78
• Attack Vector: Local
• CVSS Score: 7.3 (CVSS:3.1)
• EPSS Score: 0.00657 (Percentile: 46.42%)
• Impact: Unauthenticated OS Command Execution
• Exploit Status: Proof of Concept / Public Exploit Code Available
• CISA KEV Status: Not Listed

Affected Systems

• AWS CDK (aws-cdk-lib)
• aws-cdk-lib: < 2.245.0 (Fixed in: 2.245.0)
• aws-cdk-lib (Windows): < 2.246.0 (Fixed in: 2.246.0)

Exploit Details

• GitHub (HeshamASH): Functional proof-of-concept demonstrating command injection via the externalModules property

Mitigation Strategies

• Upgrade aws-cdk-lib to version 2.245.0 (Linux/macOS) or 2.246.0 (Windows) to enforce direct process spawning
• Use container-based (Docker) bundling to isolate execution environments
• Adopt static application security testing (SAST) tools to detect unneutralized shell strings in infrastructure definitions

Remediation Steps:

1. Identify all occurrences of NodejsFunction constructs in AWS CDK infrastructure repositories.
2. Inspect bundling parameters including externalModules, loader, define, inject, and esbuildArgs for raw unescaped input.
3. Run 'npm install aws-cdk-lib@latest' to update to a patched version.
4. Configure pipelines to verify syntax and synthesis in non-privileged environments that restrict local file and network access.

References

• NVD CVE Entry
• AWS Security Bulletin
• GitHub Security Advisory
• AWS CDK Local Bundling Pull Request #37292
• AWS CDK Windows Process Spawning Pull Request #37412
• AWS CDK Release v2.245.0
• Public Proof of Concept Repository

Read the full report for CVE-2026-11417 on our website for more details including interactive diagrams and full exploit analysis.