https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T17:22:46.082878+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326485 EUVD-2026-326485 2026-10-17T17:22:46.085070+00:00 EUVD-2026-326485 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11417 fkie_cve-2026-11417 2026-10-17T17:22:46.085100+00:00

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

 https://cve.radiocsirt.org/vuln/ghsa-999r-qq7v-r334 GHSA-999r-qq7v-r334 — aws-cdk-lib: OS Command Injection in NodejsFunction Bundling 2026-10-17T17:22:46.085143+00:00

Affected: npm: aws-cdk-lib

### Summary AWS CDK (`aws-cdk-lib`) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the `NodejsFunction` local bundling pipeline in `aws-cdk-lib` before 2.245.0 (2.246.0 on Windows) might allow a threat actor who controls the value of one or more bundling properties (`externalModules`, `define`, `loader`, `inject`, or `esbuildArgs`) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

### Impact During local Lambda bundling, `NodejsFunction` assembled an esbuild command string from the bundling properties `externalModules`, `define`, `loader`, `inject`, and `esbuildArgs` and executed it via a shell (`bash -c` on Linux/macOS, `cmd /c` on Windows) through `spawnSync`. The property values were interpolated without escaping or validation, so values containing shell metacharacters could execute arbitrary commands with the privileges of the user running `cdk synth`, `cdk deploy`, or `cdk diff`. Exploitation requires a threat actor to control one or more of the affected property values in the CDK application — for example via an untrusted npm dependency that vends a wrapper construct, or via a pull request that introduces untrusted values.

### Impacted versions: < 2.245.0 (on Windows, < 2.246.0)

### Patche…