Amplify Codegen Ui
Monthly
Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.
Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.