CVE-2026-89065 Overview
CVE-2026-89065 is a relative path traversal vulnerability [CWE-23] in the projen project synthesis tool. The flaw resides in the generated file manifest cleanup component in versions prior to 0.101.37. Context-dependent attackers can craft entries in the version-controlled generated file manifest that projen consumes during project synthesis. When processed, these entries can cause recursive deletion of files and directories outside the intended project directory, limited to paths writable by the user running projen.
Critical Impact
Malicious manifest entries can trigger recursive deletion of files outside the project directory during a routine projen synthesis run, impacting integrity and availability of developer workstations and CI environments.
Affected Products
- projen versions prior to 0.101.37
- Projects that consume the generated file manifest during synthesis
- AWS-adjacent tooling referenced in AWS Security Bulletin 2026-108
Discovery Timeline
- 2026-09-11 - CVE CVE-2026-89065 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89065
Vulnerability Analysis
projen is a project configuration synthesizer that regenerates repository files from code. To reconcile prior state, it maintains a version-controlled manifest listing files it previously generated. During synthesis, the cleanup component removes entries that are no longer produced by the current configuration.
The manifest cleanup routine failed to properly contain the paths it processed within the project root. Relative path sequences such as ../ in manifest entries escaped the intended containment boundary. Because cleanup performs recursive deletion, an attacker-controlled entry could remove arbitrary directories on the host, constrained only by filesystem permissions of the invoking user.
Root Cause
The root cause is missing or insufficient path containment validation before invoking recursive delete operations on manifest-listed paths. The component trusted the manifest as an internal artifact, but the manifest is committed to version control and can be modified by anyone contributing to the repository. The corrected containment check normalizes and validates that resolved paths remain within the project root.
Attack Vector
Exploitation requires an attacker to introduce crafted entries into the manifest file tracked in the target repository. When a developer or automation pipeline runs projen in that repository, the cleanup component processes the poisoned entries and deletes files outside the project directory. The attack requires user action to trigger synthesis, which aligns with the local attack vector and required user interaction reflected in the CVSS metrics.
No public proof-of-concept exploit has been published. See the GitHub Security Advisory GHSA-7p65-6x86-v7f3 for vendor technical details.
Detection Methods for CVE-2026-89065
Indicators of Compromise
- Manifest files under version control containing path entries with ../ traversal sequences or absolute paths outside the project root.
- Unexpected file or directory deletions on developer workstations or CI runners immediately following a projen invocation.
- Commits from untrusted contributors that modify the generated file manifest without corresponding source changes.
Detection Strategies
- Scan repositories for projen manifest entries that resolve outside the project directory after normalization.
- Inventory build and developer hosts for projen installations at versions below 0.101.37.
- Review pull request diffs that touch the projen manifest, treating any traversal patterns as suspicious.
Monitoring Recommendations
- Audit CI/CD job logs for filesystem operations executed by projen outside the workspace directory.
- Enable file integrity monitoring on developer workstations and CI runner home directories to flag unexpected deletions.
- Track projen version usage across repositories through software composition analysis tooling.
How to Mitigate CVE-2026-89065
Immediate Actions Required
- Upgrade projen to version 0.101.37 or later across all developer workstations, CI runners, and container images.
- Review the projen manifest in every repository for suspicious entries containing traversal sequences before running synthesis.
- Run projen in CI under a least-privilege user account with no write access outside the workspace directory.
Patch Information
The fix is available in projen v0.101.37. According to the vendor advisory, the corrected containment check is automatically applied by the projen runtime on the next invocation after upgrade. Refer to AWS Security Bulletin 2026-108 for AWS-specific guidance.
Workarounds
- Restrict who can modify the projen manifest through code owner rules and mandatory review policies.
- Execute projen inside an ephemeral container or sandbox with the workspace mounted read-write and no access to host paths.
- Block merges that alter manifest entries to include .. segments using a repository pre-merge check.
# Configuration example
npm install --save-dev projen@^0.101.37
npx projen --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
