CVE-2026-11417

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11417
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11417.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11417
Aliases
Published
2026-06-10T17:39:18.210Z
Modified
2026-07-15T01:48:50.672450156Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OS Command Injection in NodejsFunction Bundling in aws-cdk-lib
Details

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11417.json",
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/aws/aws-cdk

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-cdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
776e79dc2e9b2c300d46c099c07d25764f745b57
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.245.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.25.2
v0.25.3
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.36.1
v0.36.2
v0.37.0
v0.38.0
v0.39.0
v0.7.0-beta
v0.7.1-beta
v0.7.2-beta
v0.7.3-beta
v0.7.4-beta
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.13.1
v1.14.0
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.18.0
v1.19.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.0-alpha.10
v2.0.0-alpha.11
v2.0.0-alpha.12
v2.0.0-alpha.13
v2.0.0-alpha.14
v2.0.0-rc.1
v2.0.0-rc.10
v2.0.0-rc.11
v2.0.0-rc.12
v2.0.0-rc.13
v2.0.0-rc.14
v2.0.0-rc.15
v2.0.0-rc.16
v2.0.0-rc.17
v2.0.0-rc.18
v2.0.0-rc.19
v2.0.0-rc.20
v2.0.0-rc.21
v2.0.0-rc.22
v2.0.0-rc.23
v2.0.0-rc.24
v2.0.0-rc.25
v2.0.0-rc.26
v2.0.0-rc.27
v2.0.0-rc.28
v2.0.0-rc.29
v2.0.0-rc.3
v2.0.0-rc.30
v2.0.0-rc.31
v2.0.0-rc.32
v2.0.0-rc.33
v2.0.0-rc.4
v2.0.0-rc.5
v2.0.0-rc.6
v2.0.0-rc.7
v2.0.0-rc.8
v2.0.0-rc.9
v2.1.0
v2.10.0
v2.100.0
v2.101.0
v2.101.1
v2.102.0
v2.102.1
v2.103.0
v2.103.1
v2.104.0
v2.105.0
v2.106.0
v2.106.1
v2.107.0
v2.108.0
v2.108.1
v2.109.0
v2.11.0
v2.110.0
v2.110.1
v2.111.0
v2.112.0
v2.113.0
v2.114.0
v2.114.1
v2.115.0
v2.116.0
v2.116.1
v2.117.0
v2.118.0
v2.119.0
v2.12.0
v2.120.0
v2.121.0
v2.121.1
v2.122.0
v2.123.0
v2.124.0
v2.125.0
v2.126.0
v2.127.0
v2.128.0
v2.129.0
v2.13.0
v2.130.0
v2.131.0
v2.132.0
v2.132.1
v2.133.0
v2.134.0
v2.135.0
v2.136.0
v2.136.1
v2.137.0
v2.138.0
v2.139.0
v2.139.1
v2.14.0
v2.140.0
v2.141.0
v2.142.0
v2.142.1
v2.143.0
v2.143.1
v2.144.0
v2.145.0
v2.146.0
v2.147.0
v2.147.1
v2.147.2
v2.147.3
v2.148.0
v2.148.1
v2.149.0
v2.15.0
v2.150.0
v2.151.0
v2.151.1
v2.152.0
v2.153.0
v2.154.0
v2.154.1
v2.155.0
v2.156.0
v2.157.0
v2.158.0
v2.159.0
v2.159.1
v2.16.0
v2.160.0
v2.161.0
v2.161.1
v2.162.0
v2.162.1
v2.163.0
v2.163.1
v2.164.0
v2.164.1
v2.165.0
v2.166.0
v2.167.0
v2.167.1
v2.167.2
v2.168.0
v2.169.0
v2.17.0
v2.170.0
v2.171.0
v2.171.1
v2.172.0
v2.173.0
v2.173.1
v2.173.2
v2.173.3
v2.173.4
v2.174.0
v2.174.1
v2.175.0
v2.175.1
v2.176.0
v2.177.0
v2.178.0
v2.178.1
v2.178.2
v2.179.0
v2.18.0
v2.180.0
v2.181.0
v2.181.1
v2.182.0
v2.183.0
v2.184.0
v2.184.1
v2.185.0
v2.186.0
v2.187.0
v2.188.0
v2.189.0
v2.189.1
v2.19.0
v2.190.0
v2.191.0
v2.192.0
v2.193.0
v2.194.0
v2.195.0
v2.196.0
v2.196.1
v2.197.0
v2.198.0
v2.199.0
v2.2.0
v2.20.0
v2.200.0
v2.200.1
v2.200.2
v2.201.0
v2.202.0
v2.203.0
v2.203.1
v2.204.0
v2.205.0
v2.206.0
v2.207.0
v2.208.0
v2.209.0
v2.209.1
v2.21.0
v2.21.1
v2.210.0
v2.211.0
v2.212.0
v2.213.0
v2.214.0
v2.215.0
v2.216.0
v2.217.0
v2.218.0
v2.219.0
v2.22.0
v2.220.0
v2.221.0
v2.221.1
v2.222.0
v2.223.0
v2.224.0
v2.225.0
v2.226.0
v2.227.0
v2.228.0
v2.229.0
v2.229.1
v2.23.0
v2.230.0
v2.231.0
v2.232.0
v2.232.1
v2.232.2
v2.233.0
v2.234.0
v2.234.1
v2.235.0
v2.235.1
v2.236.0
v2.237.0
v2.237.1
v2.238.0
v2.239.0
v2.24.0
v2.24.1
v2.240.0
v2.241.0
v2.242.0
v2.243.0
v2.244.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.28.1
v2.29.0
v2.29.1
v2.3.0
v2.30.0
v2.31.0
v2.31.1
v2.31.2
v2.32.0
v2.32.1
v2.33.0
v2.34.0
v2.34.1
v2.34.2
v2.35.0
v2.36.0
v2.37.0
v2.37.1
v2.38.0
v2.38.1
v2.39.0
v2.39.1
v2.4.0
v2.40.0
v2.41.0
v2.42.0
v2.42.1
v2.43.0
v2.43.1
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.49.0
v2.49.1
v2.5.0
v2.50.0
v2.51.0
v2.51.1
v2.52.0
v2.52.1
v2.53.0
v2.54.0
v2.55.0
v2.55.1
v2.56.0
v2.56.1
v2.57.0
v2.58.0
v2.58.1
v2.59.0
v2.6.0
v2.60.0
v2.61.0
v2.61.1
v2.62.0
v2.62.1
v2.62.2
v2.63.0
v2.63.1
v2.63.2
v2.64.0
v2.65.0
v2.66.0
v2.66.1
v2.67.0
v2.68.0
v2.69.0
v2.7.0
v2.70.0
v2.72.0
v2.72.1
v2.73.0
v2.74.0
v2.75.0
v2.75.1
v2.76.0
v2.77.0
v2.78.0
v2.79.0
v2.79.1
v2.8.0
v2.80.0
v2.81.0
v2.82.0
v2.83.0
v2.83.1
v2.84.0
v2.85.0
v2.86.0
v2.87.0
v2.88.0
v2.89.0
v2.9.0
v2.90.0
v2.91.0
v2.92.0
v2.93.0
v2.94.0
v2.95.0
v2.95.1
v2.96.0
v2.96.1
v2.96.2
v2.97.0
v2.97.1
v2.98.0
v2.99.0
v2.99.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11417.json"