Amazon Codecatalyst Blueprints Blueprint
Monthly
OS command injection in the Amazon Web Services codecatalyst-blueprints npm package (before 0.3.156) allows a repository contributor with commit access to execute arbitrary commands inside the blueprint resynthesis environment by embedding shell metacharacters in the `owner` field of a `[local]` merge strategy entry within a crafted `.ownership-file`. The attack requires both commit access to a project repository and a resynthesis trigger event, making automated mass exploitation infeasible. No public exploit has been identified and SSVC rates exploitation as none and non-automatable; users of the managed Amazon CodeCatalyst service require no action because AWS applies independent server-side allowlist enforcement and per-project environment isolation.
OS command injection in the Amazon Web Services codecatalyst-blueprints npm package (before 0.3.156) allows a repository contributor with commit access to execute arbitrary commands inside the blueprint resynthesis environment by embedding shell metacharacters in the `owner` field of a `[local]` merge strategy entry within a crafted `.ownership-file`. The attack requires both commit access to a project repository and a resynthesis trigger event, making automated mass exploitation infeasible. No public exploit has been identified and SSVC rates exploitation as none and non-automatable; users of the managed Amazon CodeCatalyst service require no action because AWS applies independent server-side allowlist enforcement and per-project environment isolation.