{"id":"CVE-2025-4318","state":"PUBLISHED","title":"Input validation issue in AWS Amplify Studio UI component properties","description":"The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.","publishedAt":"2025-05-05T18:16:34.075Z","updatedAt":"2026-07-29T15:18:10.368Z","severity":{"score":9,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"AMZN"},"assigner":"AMZN","products":["Amazon Amplify Studio"],"affected":[{"vendor":"Amazon","product":"Amplify Studio","packageName":"amplify-codegen-ui","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","lessThan":"2.20.3","versionType":"semver"}],"collectionURL":"https://github.com/aws-amplify/amplify-codegen-ui"}],"references":["https://aws.amazon.com/security/security-bulletins/AWS-2025-010/","https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3","https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8","https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/","https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"],"weaknesses":["CWE-95"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4318.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-4318","state":"PUBLISHED","datePublished":"2025-05-05T18:16:34.075Z","dateUpdated":"2026-07-29T15:18:10.368Z","assignerShortName":"AMZN","assignerOrgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateReserved":"2025-05-05T14:03:53.695Z"},"containers":{"cna":{"title":"Input validation issue in AWS Amplify Studio UI component properties","descriptions":[{"lang":"en","value":"The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process."}],"affected":[{"vendor":"Amazon","product":"Amplify Studio","packageName":"amplify-codegen-ui","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","lessThan":"2.20.3","versionType":"semver"}],"collectionURL":"https://github.com/aws-amplify/amplify-codegen-ui"}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-010/","tags":["vendor-advisory"]},{"url":"https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3","tags":["patch"]},{"url":"https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-95","lang":"en","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"AMZN","orgId":"ff89ba41-3aa1-4d27-914a-91399e9639e5","dateUpdated":"2026-07-29T15:18:10.368Z"},"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592: Stored XSS"}]},{"capecId":"CAPEC-251","descriptions":[{"lang":"en","value":"CAPEC-251: Local Code Inclusion"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-18T16:07:11.415601Z","id":"CVE-2025-4318","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-18T16:15:55.199Z"}},{"title":"CVE Program Container","references":[{"url":"https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/"},{"url":"https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8"},{"url":"https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-01-28T19:27:08.642Z"},"x_generator":{"engine":"ADPogram 0.0.1"}}]}}}