CVE-2026-13760

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. To remediate this issue, users should upgrade to v2.260.0.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-050-aws/
https://github.com/aws/aws-cdk/releases/tag/v2.260.0
https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf

Configurations

No configuration.

History

25 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) La inyección de comandos del sistema operativo en la canalización de empaquetado Docker de NodejsFunction (ayudante OsCommand) en AWS aws-cdk-lib en todas las plataformas podría permitir a un actor que controla las cadenas de versión de las dependencias en el archivo package.json de un proyecto ejecutar comandos arbitrarios en el host que ejecuta la cadena de herramientas de CDK mediante metacaracteres de shell inyectados en el ayudante OsCommand. Este problema requiere que el actor controle el contenido de una cadena de versión de dependencia de package.json que se procesa durante el empaquetado basado en Docker con nodeModules especificado. Para remediar este problema, los usuarios deben actualizar a la v2.260.0.

Information

Published : 2026-07-01 19:16

Updated : 2026-10-25 16:10

NVD link : CVE-2026-13760

Mitre link : CVE-2026-13760

CVE.ORG link : CVE-2026-13760

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-13760", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13760", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T19:23:27.400987Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "AWS CDK", "versions": [{"status": "affected", "version": "0", "lessThan": "2.260.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-01T19:16:36.157", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-050-aws/", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-cdk/releases/tag/v2.260.0", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified.\n\n\n\nTo remediate this issue, users should upgrade to\u00a0v2.260.0."}, {"lang": "es", "value": "La inyecci\u00f3n de comandos del sistema operativo en la canalizaci\u00f3n de empaquetado Docker de NodejsFunction (ayudante OsCommand) en AWS aws-cdk-lib en todas las plataformas podr\u00eda permitir a un actor que controla las cadenas de versi\u00f3n de las dependencias en el archivo package.json de un proyecto ejecutar comandos arbitrarios en el host que ejecuta la cadena de herramientas de CDK mediante metacaracteres de shell inyectados en el ayudante OsCommand. Este problema requiere que el actor controle el contenido de una cadena de versi\u00f3n de dependencia de package.json que se procesa durante el empaquetado basado en Docker con nodeModules especificado.\n\nPara remediar este problema, los usuarios deben actualizar a la v2.260.0."}], "lastModified": "2026-10-25T16:10:00.147", "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}