Update dependency aws-cdk-lib to v2.246.0 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.164.1 → 2.246.0

---

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

CVE-2025-23206 / GHSA-v4mq-x674-ff73

More information

Details

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

Severity

• CVSS Score: 1.8 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73
• https://github.com/aws/aws-cdk/issues/32920
• https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560
• https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html
• https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34
• https://nvd.nist.gov/vuln/detail/CVE-2025-23206
• https://github.com/aws/aws-cdk/pull/32921
• https://github.com/aws/aws-cdk/releases/tag/v2.177.0
• https://github.com/advisories/GHSA-v4mq-x674-ff73

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct

GHSA-qq4x-c6h6-rfxh

More information

Details

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-qq4x-c6h6-rfxh
• https://github.com/aws/aws-cdk/commit/d02e64aac18a72195ddcdb973defea7f32382c33
• https://github.com/advisories/GHSA-qq4x-c6h6-rfxh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

AWS CDK CodePipeline: trusted entities are too broad

GHSA-5pq3-h73f-66hr

More information

Details

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre-built components called "constructs," which are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The AWS CodePipeline construct deploys CodePipeline, a managed service that orchestrates software release processes through a series of stages, each comprising one or more actions executed by CodePipeline. To perform these actions, CodePipeline assumes IAM roles with permissions necessary for each step, allowing it to interact with AWS services and resources on behalf of the user.

An issue exists where, when using CDK to create a CodePipeline with the CDK Construct Library, CDK creates an AWS Identity and Access Management (AWS IAM) trust policy with overly broad permissions. Any user with unrestricted sts:AssumeRole permissions could assume that trust policy. This issue does not affect users who supply their own role for CodePipeline.

Impact

To leverage the issue, an actor has to be authenticated in the account and have an unrestricted sts:AssumeRole permission. The permissions an actor could leverage depend on the actions added to the pipeline. Possible permissions include actions on services such as CloudFormation, CodeCommit, Lambda, and ECS, as well as access to the S3 bucket holding pipeline build artifacts (see documentation).

Users can review their AWS CloudTrail logs for when the role was assumed to determine if this was expected.

Impacted versions: <v2.189.0

Patches

The patches are included in the CDK Construct Library release v2.189.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

When new CDK applications using the latest version are initialized, they will use the new behavior with more restrictive permissions.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/pipelines:reduceStageRoleTrustScope) and (@​aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope) to true and redeploy the application to apply this fix and use the new behavior with more restrictive permissions.

Workarounds

You can explicitly supply the role for your CodePipeline and follow the policy recommendations detailed in CodePipeline documentation.

References

Original reporting issue.

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

• CVSS Score: 3.8 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr
• https://github.com/aws/aws-cdk/issues/33709
• https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf
• https://github.com/aws/aws-cdk/releases/tag/v2.184.0
• https://github.com/advisories/GHSA-5pq3-h73f-66hr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

CVE-2026-11417 / GHSA-999r-qq7v-r334

More information

Details

Summary

AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow a threat actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

Impact

During local Lambda bundling, NodejsFunction assembled an esbuild command string from the bundling properties externalModules, define, loader, inject, and esbuildArgs and executed it via a shell (bash -c on Linux/macOS, cmd /c on Windows) through spawnSync. The property values were interpolated without escaping or validation, so values containing shell metacharacters could execute arbitrary commands with the privileges of the user running cdk synth, cdk deploy, or cdk diff. Exploitation requires a threat actor to control one or more of the affected property values in the CDK application — for example via an untrusted npm dependency that vends a wrapper construct, or via a pull request that introduces untrusted values.

Impacted versions:

< 2.245.0 (on Windows, < 2.246.0)

Patches

This issue has been addressed in aws-cdk-lib version 2.245.0 (PR #​37292), with a Windows-specific regression fix in 2.246.0 (PR #​37412). The fix replaces shell-based command execution with array-based spawnSync invocation that does not invoke a shell. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Ensure the values supplied to NodejsFunction bundling properties (externalModules, define, loader, inject, esbuildArgs) originate only from trusted sources, and audit third-party constructs and pull requests that set them. Upgrading to a fixed version is the recommended remediation.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

AWS would like to thank the external researcher Hesham Ashraf who reported this issue through the AWS Vulnerability Disclosure Program (HackerOne) for collaborating on it through the coordinated vulnerability disclosure process.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334
• https://nvd.nist.gov/vuln/detail/CVE-2026-11417
• https://github.com/aws/aws-cdk/pull/37292
• https://github.com/aws/aws-cdk/pull/37412
• https://aws.amazon.com/security/security-bulletins/2026-041-aws
• https://github.com/aws/aws-cdk/releases/tag/v2.245.0
• https://github.com/advisories/GHSA-999r-qq7v-r334

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider

CVE-2025-23206 / GHSA-v4mq-x674-ff73

More information

Details

Impact

Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34.

However, the current tls.connect method will always set rejectUnauthorized: false which is a potential security concern. CDK should follow the best practice and set rejectUnauthorized: true. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag.

Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack.

As a best practice, CDK should still fix this issue under a feature flag to avoid regression.

packages/@​aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts
❯❱ problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized
to false bypasses verification against the list of trusted CAs, which also leads to insecure
transport.

Patches

The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22).
Once upgraded, please make sure the feature flag '@​aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in cdk.context.json or cdk.json. More details on feature flag setting is here.

Workarounds

N/A

References

https://github.com/aws/aws-cdk/issues/32920

Severity

• CVSS Score: 1.8 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-v4mq-x674-ff73
• https://nvd.nist.gov/vuln/detail/CVE-2025-23206
• https://github.com/aws/aws-cdk/issues/32920
• https://github.com/aws/aws-cdk/pull/32921
• https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560
• https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html
• https://github.com/aws/aws-cdk
• https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34
• https://github.com/aws/aws-cdk/releases/tag/v2.177.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct

GHSA-qq4x-c6h6-rfxh

More information

Details

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create their own applications which are converted to AWS CloudFormation templates during deployment to a customer’s AWS account. CDK contains pre-built components called "constructs" that are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The CDK Cognito UserPool construct deploys an AWS cognito user pool. An Amazon Cognito user pool is a user directory for web and mobile app authentication and authorization. Customers can deploy a client under this user pool through construct ‘UserPoolClient’ or through helper method 'addClient'. A user pool client resource represents an Amazon Cognito user pool client which is a configuration within a user pool that interacts with one mobile or web application authenticating with Amazon Cognito.

When users of the 'cognito.UserPoolClient' construct generate a secret value for the application client in AWS CDK, they can then reference the generated secrets in their stack. The CDK had an issue where, when the custom resource performed an SDK API call to 'DescribeCognitoUserPoolClient' to retrieve the generated secret, the full response was logged in the associated lambda function's log group. Any user authenticated in the account where logs of the custom resource are accessible and who has read-only permission could view the secret written to those logs.

This issue does not affect customers who are generating the secret value outside of the CDK as the secret is not referenced or logged.

Impact

To leverage this issue, an actor has to be authenticated in the account where logs of the custom resource Custom::DescribeCognitoUserPoolClient are accessible and have read-only permission for lambda function logs.

Users can review access to their log group through AWS CloudTrail logs to detect any unexpected access to read the logs.

Impacted versions: >2.37.0 and <=2.187.0

Patches

The patches are included in the AWS CDK Library release v2.187.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. To fully address this issue, users should rotate the secret by generating a new secret stored in AWS Secrets Manager. References to the secret will use the new secret on update.

When new CDK applications using the latest version are initialized, they will use the new behavior with updated logging.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/cognito:logUserPoolClientSecretValue) to false, redeploy the application to apply this fix and use the new implementation with updated logging behavior.

Workarounds

Users can override the implementation changing Logging to be Logging.withDataHidden(). For example define class CustomUserPoolClient extends UserPoolClient and  in the new class define get userPoolClientSecret() to use Logging.withDataHidden().

Example

export class CustomUserPoolClient extends UserPoolClient {

  private readonly customUserPool : UserPool;
  private readonly customuserPoolClientId : string;
  constructor(scope: Construct, id: string, props: UserPoolClientProps) {
    super(scope, id, props);

    this.customUserPool = new UserPool(this, 'pool', {
      removalPolicy: RemovalPolicy.DESTROY,
    });

    const client = this.customUserPool.addClient('client', { generateSecret: true });
  }

  // Override the userPoolClientSecret getter to always return the secret
  public get userPoolClientSecret(): SecretValue {
    // Create the Custom Resource that assists in resolving the User Pool Client secret
    const secretValue = SecretValue.resourceAttribute(new AwsCustomResource(
      this,
      'DescribeCognitoUserPoolClient',
      {
    resourceType: 'Custom::DescribeCognitoUserPoolClient',
    onUpdate: {
      region: cdk.Stack.of(this).region,
      service: 'CognitoIdentityServiceProvider',
      action: 'describeUserPoolClient',
      parameters: {
        UserPoolId: this.customUserPool.userPoolId,
        ClientId: this.customUserPool,
      },
      physicalResourceId: PhysicalResourceId.of(this.userPoolClientId),
      // Disable logging of sensitive data
      logging: Logging.withDataHidden(),
    },
    policy: AwsCustomResourcePolicy.fromSdkCalls({
      resources: [this.customUserPool.userPoolArn],
    }),
    installLatestAwsSdk: false,
      },
    ).getResponseField('UserPoolClient.ClientSecret'));
    
    return secretValue;
  }
}

References

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-qq4x-c6h6-rfxh
• https://github.com/aws/aws-cdk/commit/d02e64aac18a72195ddcdb973defea7f32382c33
• https://github.com/aws/aws-cdk

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

AWS CDK CodePipeline: trusted entities are too broad

GHSA-5pq3-h73f-66hr

More information

Details

Summary

The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre-built components called "constructs," which are higher-level abstractions providing defaults and best practices. This approach enables developers to use familiar programming languages to define complex cloud infrastructure more efficiently than writing raw CloudFormation templates.

The AWS CodePipeline construct deploys CodePipeline, a managed service that orchestrates software release processes through a series of stages, each comprising one or more actions executed by CodePipeline. To perform these actions, CodePipeline assumes IAM roles with permissions necessary for each step, allowing it to interact with AWS services and resources on behalf of the user.

An issue exists where, when using CDK to create a CodePipeline with the CDK Construct Library, CDK creates an AWS Identity and Access Management (AWS IAM) trust policy with overly broad permissions. Any user with unrestricted sts:AssumeRole permissions could assume that trust policy. This issue does not affect users who supply their own role for CodePipeline.

Impact

To leverage the issue, an actor has to be authenticated in the account and have an unrestricted sts:AssumeRole permission. The permissions an actor could leverage depend on the actions added to the pipeline. Possible permissions include actions on services such as CloudFormation, CodeCommit, Lambda, and ECS, as well as access to the S3 bucket holding pipeline build artifacts (see documentation).

Users can review their AWS CloudTrail logs for when the role was assumed to determine if this was expected.

Impacted versions: <v2.189.0

Patches

The patches are included in the CDK Construct Library release v2.189.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

When new CDK applications using the latest version are initialized, they will use the new behavior with more restrictive permissions.

Existing applications must upgrade to the latest version, change the feature flag (@​aws-cdk/pipelines:reduceStageRoleTrustScope) and (@​aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope) to true and redeploy the application to apply this fix and use the new behavior with more restrictive permissions.

Workarounds

You can explicitly supply the role for your CodePipeline and follow the policy recommendations detailed in CodePipeline documentation.

References

Original reporting issue.

If you have any questions or comments about this advisory please contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

• CVSS Score: 3.8 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr
• https://github.com/aws/aws-cdk/issues/33709
• https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf
• https://github.com/aws/aws-cdk
• https://github.com/aws/aws-cdk/releases/tag/v2.184.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

CVE-2026-11417 / GHSA-999r-qq7v-r334

More information

Details

Summary

AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow a threat actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

Impact

During local Lambda bundling, NodejsFunction assembled an esbuild command string from the bundling properties externalModules, define, loader, inject, and esbuildArgs and executed it via a shell (bash -c on Linux/macOS, cmd /c on Windows) through spawnSync. The property values were interpolated without escaping or validation, so values containing shell metacharacters could execute arbitrary commands with the privileges of the user running cdk synth, cdk deploy, or cdk diff. Exploitation requires a threat actor to control one or more of the affected property values in the CDK application — for example via an untrusted npm dependency that vends a wrapper construct, or via a pull request that introduces untrusted values.

Impacted versions:

< 2.245.0 (on Windows, < 2.246.0)

Patches

This issue has been addressed in aws-cdk-lib version 2.245.0 (PR #​37292), with a Windows-specific regression fix in 2.246.0 (PR #​37412). The fix replaces shell-based command execution with array-based spawnSync invocation that does not invoke a shell. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Ensure the values supplied to NodejsFunction bundling properties (externalModules, define, loader, inject, esbuildArgs) originate only from trusted sources, and audit third-party constructs and pull requests that set them. Upgrading to a fixed version is the recommended remediation.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

AWS would like to thank the external researcher Hesham Ashraf who reported this issue through the AWS Vulnerability Disclosure Program (HackerOne) for collaborating on it through the coordinated vulnerability disclosure process.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334
• https://nvd.nist.gov/vuln/detail/CVE-2026-11417
• https://github.com/aws/aws-cdk/pull/37292
• https://github.com/aws/aws-cdk/pull/37412
• https://aws.amazon.com/security/security-bulletins/2026-041-aws
• https://github.com/aws/aws-cdk
• https://github.com/aws/aws-cdk/releases/tag/v2.245.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.246.0

Compare Source

Features

• bedrock: add MiniMax and GLM foundation model identifiers (#​37348) (2015344), closes #​37347

Bug Fixes

• dynamodb: throw error when grantee is an unsupported ServicePrincipal (#​37335) (d12754f), closes #​35817 /github.com/aws/aws-cdk/issues/37273#issuecomment-4099645443
• lambda-nodejs: use powershell for spawn steps on Windows (#​37412) (a92105c), closes #​37387
• core: noisy property deprecation warnings (#​37415) (4fd0002), closes #​37407

Reverts

• core: add source tracing for L1 construct property mutations (#​37415) (4fd0002), closes aws/aws-cdk#37285

---

Alpha modules (2.246.0-alpha.0)

v2.245.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​37332) (6cdf84a)
• autoscaling: add instanceLifecyclePolicy support to AutoScalingGroup Property (#​36434) (b72ffcc)
• cloudfront: use JavaScript runtime 2.0 as the default for CloudFront Functions (under feature flag) (#​35941) (cd0df14)
• core: add source tracing for L1 construct property mutations (#​37285) (f0b6da8)
• ecr-assets: add support for docker build context (#​36930) (c0849ea), closes #​31598
• s3: add blockedEncryptionTypes field to s3.Bucket (#​37047) (262e8a7), closes #​36988
• synthetics: add enum value for Synthetics Canary NodeJS 3.1 runtime (#​37282) (af1e89c), closes /docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Library_Nodejs.html#CloudWatch_Synthetics_runtimeversion-syn-nodejs-3

Bug Fixes

• aws-cdk-lib: toolkit is unaware of CDK app errors (#​37294) (093de92)
• eks: throw error when kubectl subnets are isolated (#​37217) (73e5006), closes #​26613
• lambda: fix typo in addPermission() warning message (#​37365) (fa21e62)
• lambda-nodejs: use direct spawn for local bundling (#​37292) (9bf4263)
• mixin: use withMixin in Stack to set mixin metadata in its constructs (#​37269) (293ce90), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/mixins/private/mixin-metadata.ts#L30
• rds: enablePerformanceInsights false is ignored when other performance insight properties are set (#​37287) (b4bca75), closes #​37051
• construct errors are rendered in a messy way (#​37290) (5104256)
• spec2cdk: throw on unrecognized uppercase prefix in event pattern (#​37283) (c68f2f5)

---

Alpha modules (2.245.0-alpha.0)

Features

• s3tables-alpha: add support for partition spec, sort order, and table properties (#​36811) (2696cd1)
• s3tables-alpha: add metrics configuration support for TableBucket (#​37275) (e8786f5)
• s3tables-alpha: implement ITaggableV2 on TableBucket and Table L2 constructs (#​37277) (69c8944), closes #​33054

v2.244.0

Compare Source

Features

• codebuild: add support for macOS 26 runners (#​37240) (1b7b292), closes #​37241 #​35836
• update L1 CloudFormation resource definitions (#​37260) (40a5142)
• rds: add standalone resource creation for ParameterGroup (#​37165) (5441a51), closes #​9741
• ecs: add forceNewDeployment feature for ecs service (#​35726) (d16dc7e), closes #​27762
• mixins: helpers to convert between Aspects and Mixins (#​37235) (4537f69)
• spec2cdk: add actions() method to Grants classes (#​36987) (bbeaf5d)

Bug Fixes

• aws-cdk-lib: error annotations now have error codes (#​37270) (0b9629e)
• eks: clear OCI repo/version after local pull for Helm v4 compatibility (#​37142) (e6a8804), closes /github.com/helm/helm/blob/v3.19.0/pkg/action/install.go#L753-L769 /github.com/helm/helm/blob/main/pkg/action/install.go#L893-L909
• all errors now have error codes (#​36934) (408c12f)

---

Alpha modules (2.244.0-alpha.0)

Bug Fixes

• kinesisanalytics-flink-alpha: mark deprecated flink runtimes as deprecated (#​37155) (0a89447)

v2.243.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​37201) (85daaf5)
• cfn-property-mixins: graduate to stable @​aws-cdk/cfn-property-mixins package (#​37215) (f071e67)

Bug Fixes

• dynamodb: resource policies don't have the index ARNs when indexes are added after granting permissions (#​37213) (eb37071)

---

Alpha modules (2.243.0-alpha.0)

v2.242.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  • aws-ssm: AWS::SSM::MaintenanceWindow: Id attribute removed.

Features

• core: support PropertyMergeStrategy to merge arbitrary CFN property objects (#​37206) (793ad97)
• ecr: add RepositoryAutoDeleteImages mixin (#​37176) (3189116)
• s3 and ecs service mixins are now available in aws-cdk-lib (#​37151) (52c99da)
• update L1 CloudFormation resource definitions (#​37173) (1dfaf5f), closes #​37BFF5 #​37BFF5
• apigateway: add TLS 1.3 security policies for domain names (#​36303) (9d0300b), closes #​36280
• appsync: add EnhancedMetricsConfigProperty for GraphQL api (#​35328) (ebfaf89), closes #​29933
• opensearchservice: s3 vectors engine (#​36382) (c0b1d4e)
• s3: graduate BucketAutoDeleteObjects mixin into aws-cdk-lib (#​37161) (e5ddd79)

Bug Fixes

• aws-cdk-lib: Asset uses a lot of memory (#​37186) (70cae75)
• large amounts of metadata can break 512MB string limit (#​34480) (20c3154)
• opensearchservice: enableAutoSoftwareUpdate: false is not reflected in the CloudFormation template (#​37152) (dec8e6f), closes #​36382
• s3: discover existing bucket policies in def

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: cdk/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: sbt-aws-moesif@0.1.2
npm error Found: @cdklabs/sbt-aws@0.5.12
npm error node_modules/@cdklabs/sbt-aws
npm error   @cdklabs/sbt-aws@"^0.5.7" from the root project
npm error   @cdklabs/sbt-aws@"^0.5.12" from sbt-aws-descope@1.0.4
npm error   node_modules/sbt-aws-descope
npm error     sbt-aws-descope@"^1.0.4" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @cdklabs/sbt-aws@"^0.3.3" from sbt-aws-moesif@0.1.2
npm error node_modules/sbt-aws-moesif
npm error   sbt-aws-moesif@"^0.1.2" from the root project
npm error
npm error Conflicting peer dependency: @cdklabs/sbt-aws@0.3.9
npm error node_modules/@cdklabs/sbt-aws
npm error   peer @cdklabs/sbt-aws@"^0.3.3" from sbt-aws-moesif@0.1.2
npm error   node_modules/sbt-aws-moesif
npm error     sbt-aws-moesif@"^0.1.2" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-06-16T03_55_06_196Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-06-16T03_55_06_196Z-debug-0.log

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sbt-aws-sample-app	Ready	Preview, Comment	Jun 16, 2026 3:56am