CVE-2026-11417

Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.245.0 aws-cdk-lib versions prior to 2.246.0 (Windows)

Description OS command injection exists in the NodejsFunction local bundling pipeline. An actor who controls the value of one or more bundling properties—externalModules, define, loader, inject, or esbuildArgs—can execute arbitrary commands on the host running the CDK toolchain by injecting shell metacharacters. This occurs because NodejsFunction assembles an esbuild command string from these properties and executes it via a shell (bash -c on Linux/macOS or cmd /c on Windows) using the spawnSync() function without proper escaping or validation. Exploitation can happen during cdk synth, cdk deploy, or cdk diff operations, potentially through untrusted npm dependencies or malicious pull requests.

Recommendations Upgrade to version 2.245.0 or later. Upgrade to version 2.246.0 or later (Windows). Ensure the values supplied to the bundling properties externalModules, define, loader, inject, and esbuildArgs originate only from trusted sources and audit third-party constructs and pull requests that set them.