PT-2026-66564 · Amazon · @Aws-Amplify/Codegen-Ui-React

CVE-2026-18245

·

Published

2026-07-30

·

Updated

2026-08-10

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Amazon @aws-amplify/codegen-ui-react versions prior to 2.20.6
Description Improper control of code generation allows a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts. This occurs through the use of crafted Studio component or theme schema values, resulting from insufficient coverage and effectiveness of input validation.
Recommendations Upgrade to version 2.20.6.

Exploit

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-18245
GHSA-74XX-RJGF-M69J

Affected Products

@Aws-Amplify/Codegen-Ui-React