CVE-2026-13760: AWS CDK NodejsFunction RCE Vulnerability

CVE-2026-13760 Overview

CVE-2026-13760 is an OS command injection vulnerability [CWE-78] in the NodejsFunction Docker bundling pipeline of the AWS Cloud Development Kit (aws-cdk-lib). The flaw resides in the OsCommand helper, which processes dependency version strings from a project's package.json during Docker-based bundling with nodeModules specified. An actor who controls those version strings can inject shell metacharacters that execute arbitrary commands on the host running the CDK toolchain. AWS addressed the issue in aws-cdk-lib v2.260.0.

Critical Impact
Attackers who influence package.json dependency version strings can execute arbitrary OS commands on developer workstations or CI/CD hosts that run cdk synth or cdk deploy.

Affected Products

AWS aws-cdk-lib versions prior to v2.260.0
Projects using NodejsFunction with Docker-based bundling and nodeModules specified
CDK toolchain hosts across all platforms (Linux, macOS, Windows)

Discovery Timeline

2026-07-01 - CVE-2026-13760 published to NVD
2026-07-01 - AWS publishes Security Bulletin 2026-050 and GitHub Security Advisory GHSA-vcrf-j523-4mrf
2026-07-01 - aws-cdk v2.260.0 released with fix
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13760

Vulnerability Analysis

The AWS CDK NodejsFunction construct bundles Lambda function code by launching a Docker container and installing declared dependencies. When developers set nodeModules in the bundling options, the CDK reads each dependency name and version string from the project's package.json and passes those values into shell commands via the internal OsCommand helper. The helper concatenates untrusted strings into a command line without escaping shell metacharacters. An attacker who can influence a dependency version, for example through a malicious pull request, a compromised transitive lockfile entry, or a poisoned template, embeds characters such as ;, &&, |, or backticks in the version string. When the developer or CI runner executes cdk synth or cdk deploy, the shell interprets those metacharacters and runs attacker-controlled commands with the privileges of the CDK process.

Root Cause

The root cause is unsafe construction of shell command strings in the OsCommand helper. Dependency version values were treated as trusted input and interpolated directly into a shell context rather than passed as argument arrays or validated against an allowlist of semver-compatible characters.

Attack Vector

Exploitation requires local execution of the CDK toolchain against a project whose package.json contains an attacker-influenced dependency version string. The attack requires user interaction, meaning a developer or automated pipeline must invoke bundling. Successful exploitation yields arbitrary command execution on the build host, which can lead to credential theft (AWS access keys, session tokens, Git credentials), supply-chain tampering of Lambda artifacts, and lateral movement into AWS accounts.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-vcrf-j523-4mrf for vendor details.

Detection Methods for CVE-2026-13760

Indicators of Compromise

Unexpected child processes spawned by node, npm, yarn, or docker during cdk synth or cdk deploy operations
Outbound network connections from build hosts to unfamiliar endpoints during CDK bundling
package.json or lockfile entries containing shell metacharacters (;, &&, |, backticks, $() inside version fields
Modifications to AWS credential files (~/.aws/credentials, environment variables) shortly after CDK bundling runs

Detection Strategies

Scan repositories and pull requests for non-semver characters in package.json dependency version fields before merge
Audit CI/CD job logs for shell commands invoked by the CDK bundling step that do not match expected npm install patterns
Monitor developer endpoints and build agents for aws-cdk-lib versions below v2.260.0 using software composition analysis

Monitoring Recommendations

Enable process-tree telemetry on build hosts to correlate CDK invocations with any spawned shells or network utilities
Alert on AWS CloudTrail activity originating from CI/CD identities immediately after CDK deployments, focusing on unusual sts:GetCallerIdentity or credential-exfiltration patterns
Track dependency version diffs in code review tooling and flag values that deviate from strict semver syntax

How to Mitigate CVE-2026-13760

Immediate Actions Required

Upgrade aws-cdk-lib to v2.260.0 or later across all developer workstations, CI/CD runners, and container images
Audit existing package.json files and lockfiles for suspicious version strings containing shell metacharacters
Rotate AWS credentials and Git tokens used on any build host that ran vulnerable CDK versions with untrusted package.json input

Patch Information

AWS released the fix in aws-cdk-lib v2.260.0. Refer to the GitHub Release v2.260.0 and the AWS Security Bulletin 2026-050 for the full advisory and remediation guidance.

Workarounds

Avoid using NodejsFunction Docker bundling with nodeModules for projects that ingest untrusted package.json content until patched
Enforce strict semver validation on dependency version strings in pre-commit hooks and pull-request checks
Run CDK bundling inside isolated, ephemeral build environments with no long-lived AWS credentials mounted

bash

# Upgrade aws-cdk-lib to the fixed version
npm install aws-cdk-lib@2.260.0 --save-exact

# Verify the installed version
npm ls aws-cdk-lib