Remote code execution in AWS Amplify Studio codegen-ui via unsafe expression evaluation (CVE-2025-4318)

The @aws-amplify/codegen-ui package evaluates UI component property expressions (such as placeholder, label, and value fields) using unsafe dynamic execution functions-eval(), new Function(), and vm.runInNewContext()-without input validation or sandboxing. An authenticated user with access to create or modify components can inject arbitrary JavaScript that executes in the Node.js runtime during component rendering or build, with access to core modules including child_process, fs, and process.env. Public POC available. Affected versions: - <= 2.20.2 We recommend updating to: 2.20.3. CVSS 9.0 · our assessment: act_now Reference: https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce Details: https://vuln.today/cve/CVE-2025-4318