Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-15895

OS command injection in jsii-diff in AWS jsii

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AWS jsii

Default version status: unaffected

  • 0 to < 1.131.0affected

References