tag: command injection

AWS jsii-diff, a CLI tool for comparing API differences between jsii assemblies, has a critical OS command injection flaw (CVE-2026-15895). Attackers can execute arbitrary shell commands through specially crafted command-line arguments. If you're running jsii-diff versions below 1.131.0, update immediately—this one's not optional, folks.

AWS CDK (aws-cdk-lib) versions before 2.260.0 have a nasty OS command injection flaw in NodejsFunction Docker bundling. If someone controls your package.json dependency versions, they can execute arbitrary commands on your build machine through shell metacharacters. Action required: upgrade to 2.260.0+ if you use Docker-based bundling with nodeModules.