Which versions of AWS CDK are affected by CVE-2026-11417?

AWS CDK users face a critical build infrastructure risk: a command injection vulnerability in aws-cdk-lib (versions < 2.245.0) could allow attackers to inject and execute malicious code directly on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-11417?

Yes, a public proof-of-concept exploit is available for CVE-2026-11417. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11417?

Within 24 hours: Audit all aws-cdk-lib deployments to identify affected versions (< 2.245.0 on Linux/macOS, < 2.246.0 on Windows). Within 7 days: Update aws-cdk-lib to version 2.245.0 or later (2.246.0 or later on Windows) on all development and CI/CD systems. Within 30 days: Complete regression testing of CDK applications post-update and validate build pipeline integrity.

AWS CDK CVE-2026-11417

Q: What is the CVSS score of CVE-2026-11417?

CVE-2026-11417 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Is there a public PoC exploit available for CVE-2026-11417?

Yes, a public proof-of-concept exploit is available for CVE-2026-11417. Prioritise patching immediately. EPSS: 0.0%.

Q: How to fix or mitigate CVE-2026-11417?

Within 24 hours: Audit all aws-cdk-lib deployments to identify affected versions (< 2.245.0 on Linux/macOS, < 2.246.0 on Windows). Within 7 days: Update aws-cdk-lib to version 2.245.0 or later (2.246.0 or later on Windows) on all development and CI/CD systems. Within 30 days: Complete regression testing of CDK applications post-update and validate build pipeline integrity.

EUVD-2026-36076 HIGH

OS Command Injection (CWE-78)

2026-06-10 AMZN

GHSA-999r-qq7v-r334

Command Injection AWS Microsoft Aws Cloud Development Kit Library

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 18:50 vuln.today

Analysis Generated

Jun 10, 2026 - 18:50 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

7.3 (HIGH) 7.0 (HIGH)

CVE Published

Jun 10, 2026 - 17:39 nvd

HIGH 7.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on aws-cdk-lib (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.246.0.

DescriptionCVE.org

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.

AnalysisAI

OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows) allows an actor controlling bundling property values (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via shell metacharacter injection. The flaw, reported by Amazon and tracked under GHSA-999r-qq7v-r334, affects developer and CI/CD machines synthesizing CDK applications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

AWS CDK (Cloud Development Kit) is an infrastructure-as-code framework where aws-cdk-lib provides the NodejsFunction construct, which bundles Lambda function code locally using esbuild. During bundling, properties such as externalModules, define, loader, inject, and esbuildArgs are concatenated into shell command invocations to esbuild. Per CWE-78 (Improper Neutralization of Special Elements used in an OS Command), these values are not adequately sanitized before being passed to the shell, meaning metacharacters like ;, &&, |, or backticks injected into those properties are interpreted by the host shell. The affected CPE is cpe:2.3:a:aws:aws_cloud_development_kit_library:*:*:*:*:*:*:*:*, and the Windows-specific delayed fix (2.246.0) suggests platform-specific shell parsing nuances required an additional patch.

RemediationAI

Vendor-released patch: upgrade aws-cdk-lib to 2.245.0 or later on Linux/macOS and to 2.246.0 or later on Windows, as referenced in https://github.com/aws/aws-cdk/releases/tag/v2.245.0 and the AWS security bulletin https://aws.amazon.com/security/security-bulletins/2026-041-aws/. Where immediate upgrade is not possible, treat all values flowing into NodejsFunction bundling properties (externalModules, define, loader, inject, esbuildArgs) as untrusted and hard-code them in source rather than deriving them from environment variables, CLI parameters, configuration files, or third-party constructs; this trade-off reduces flexibility for dynamic builds but eliminates the injection path. Additionally, run CDK synth in isolated CI runners with no long-lived cloud credentials and review pull requests for changes to NodejsFunction bundling options, accepting that PR-review and runner isolation add process overhead but contain blast radius if a malicious value slips in before the upgrade is deployed.