Virtual Engineering Workbench EUVD-2026-115348

Exploitation requires (1) valid authenticated access at low privilege (PR:L) to the product versioning API of a deployed Amazon Virtual Engineering Workbench instance, and (2) the ability to submit a CloudFormation template body - the injected code path is the publishing component's AMI-product handler that renders the submitted template body through jinja2.Template without sandboxing. The specific trigger is a template body containing Jinja2 control sequences ({{ }}, {% %}, or {

#}) that reach the template engine. Limiting factors: the attacker must already be an authenticated third party (not unauthenticated), so this is not exploitable against anonymous requests; impact scope (cross-tenant data/resource access) is bounded by the permissions granted to the publishing Lambda's IAM role.

This is a genuine high-priority issue, not a CVSS-inflated one. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-privilege authentication, with HIGH confidentiality, integrity and availability impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - the subsequent-system HIGH ratings align with the description's claim of cross-tenant access to data and resources, since code runs with the publishing Lambda's IAM role. The CWE-1336 (SSTI) classification and the patch (replacing a raw jinja2.Template with a SandboxedEnvironment plus input rejection of Jinja2 control sequences) corroborate a server-side template injection leading to RCE. The vuln.today decision label is act_now and the vendor is the reporter (AMZN), both reinforcing priority. Signal gaps to note: no EPSS score, no CISA KEV listing, and no formally catalogued PoC are present in the input, so real-world exploitation volume cannot be quantified - the urgency here rests on the decision label, the self-reported critical severity, and the confirmed code-level root cause rather than on observed exploitation. The only meaningful limiter is PR:L: an attacker must hold valid low-privilege access to the product versioning API.

A low-privilege authenticated user of the Virtual Engineering Workbench submits a product version through the versioning API with a CloudFormation template body that embeds Jinja2 template-engine directives. When the publishing component renders the template with an unsandboxed jinja2.Template, the injected directives execute server-side, running arbitrary code under the publishing Lambda's IAM role and reaching data and resources across all tenant projects. No formally published exploit is listed in the input, but the patch commit's regression test publicly discloses a working payload ({{ self.__init__.__globals__['os'].popen('id').read() }}).