CVE-2026-11417: AWS CDK Library RCE Vulnerability

CVE-2026-11417 Overview

CVE-2026-11417 is an operating system command injection vulnerability [CWE-78] in the NodejsFunction local bundling pipeline of aws-cdk-lib. The flaw affects versions before 2.245.0 on Linux and macOS, and before 2.246.0 on Windows. An attacker who controls the value of one or more bundling properties such as externalModules, define, loader, inject, or esbuildArgs can inject shell metacharacters that execute arbitrary commands on the host running the AWS Cloud Development Kit (CDK) toolchain. Exploitation requires the attacker to influence one of these properties inside the CDK application source.

Critical Impact
An actor controlling affected bundling property values can execute arbitrary OS commands on the developer workstation or CI/CD host running the CDK toolchain, leading to code execution in the build environment.

Affected Products

aws-cdk-lib versions before 2.245.0 on Linux and macOS
aws-cdk-lib versions before 2.246.0 on Windows
AWS CDK NodejsFunction construct using the local bundling pipeline

Discovery Timeline

2026-06-10 - CVE-2026-11417 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11417

Vulnerability Analysis

The NodejsFunction construct in aws-cdk-lib bundles Lambda function code locally using esbuild. The local bundling pipeline assembles a shell command string that includes user-supplied bundling configuration values. The pipeline does not properly escape or sanitize values passed through externalModules, define, loader, inject, or esbuildArgs before passing them to the shell.

When an attacker controls any of these property values, injected shell metacharacters such as ;, &&, |, or backticks break out of the intended argument context. The injected commands then execute under the identity of the user running cdk synth, cdk deploy, or any tool that triggers bundling. This typically grants access to AWS credentials, source repositories, and build artifacts on the host.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The bundling pipeline concatenates property values into a shell command without applying argument escaping or invoking the bundler through a safe execFile-style API. Any string containing shell metacharacters is interpreted by the shell instead of being treated as a literal argument.

Attack Vector

Exploitation requires the attacker to control the value of at least one affected bundling property in the CDK application. Realistic attack paths include a supply-chain compromise of a dependency that contributes CDK configuration, a malicious pull request modifying construct properties, or untrusted input flowing into a CDK app at build time. The attack vector is local: the malicious value executes when a developer or CI pipeline runs the CDK toolchain. User interaction is required, since a build or synthesis command must be invoked.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-999r-qq7v-r334 for vendor-provided technical details.

Detection Methods for CVE-2026-11417

Indicators of Compromise

Unexpected child processes spawned by node, esbuild, or cdk during bundling, such as sh, bash, cmd.exe, powershell.exe, curl, or wget
CDK property values in source control containing shell metacharacters (;, &&, ||, |, backticks, $() inside externalModules, define, loader, inject, or esbuildArgs
Outbound network connections from CI build agents during cdk synth or cdk deploy to untrusted hosts

Detection Strategies

Scan CDK source repositories for NodejsFunction constructs and flag literal or interpolated values in the five affected properties that contain shell metacharacters.
Monitor process telemetry on developer workstations and CI runners for shell processes whose parent is the Node.js bundler invoked by CDK.
Inventory installed aws-cdk-lib versions across build environments and alert on versions earlier than 2.245.0 (or 2.246.0 on Windows).

Monitoring Recommendations

Enable command-line auditing on build hosts to capture full argument strings passed to sh, bash, and cmd.exe.
Forward CI/CD job logs and process events to a centralized analytics platform and alert on anomalous executables launched during synthesis or deployment steps.
Review AWS CloudTrail for unexpected API activity originating from build host credentials shortly after CDK runs.

How to Mitigate CVE-2026-11417

Immediate Actions Required

Upgrade aws-cdk-lib to 2.245.0 or later on Linux and macOS, and to 2.246.0 or later on Windows.
Audit all CDK applications for NodejsFunction usage and confirm that values for externalModules, define, loader, inject, and esbuildArgs are sourced from trusted, static inputs.
Rotate AWS credentials and secrets accessible from any build host that ran a vulnerable CDK toolchain with untrusted inputs.

Patch Information

Amazon Web Services published fixes in aws-cdk-lib2.245.0 (Linux and macOS) and 2.246.0 (Windows). Details are available in the AWS Security Bulletin 2026-041 and the GitHub Release v2.245.0.

Workarounds

Restrict write access to CDK application code and dependency manifests so untrusted contributors cannot modify bundling properties.
Pin and verify CDK-related dependencies, and review pull requests that touch NodejsFunction configuration.
Run cdk synth and cdk deploy in isolated, ephemeral build environments with least-privilege AWS credentials until the upgrade is complete.

bash

# Upgrade aws-cdk-lib to a fixed version
npm install aws-cdk-lib@^2.245.0

# Verify the installed version
npm list aws-cdk-lib