CVE-2026-89066: Projen Task Synthesis RCE Vulnerability

CVE-2026-89066 Overview

CVE-2026-89066 is an OS command injection vulnerability in projen, a project generation and configuration-as-code tool. The flaw resides in the task synthesis component of projen versions before 0.103.0. Attackers can inject shell metacharacters through project configuration values and repository file names that projen interpolates into generated task definitions. When developers or continuous integration (CI) runners execute the resulting .projen/tasks.json tasks, the injected commands run in the host shell context. The issue is tracked as [CWE-78] Improper Neutralization of Special Elements Used in an OS Command.

Critical Impact

Context-dependent attackers can execute arbitrary commands on developer workstations and CI runners by supplying malicious configuration values or repository file names that projen interpolates into task definitions.

Affected Products

• projen versions prior to 0.103.0
• Repositories with committed .projen/tasks.json generated by vulnerable projen versions
• CI/CD pipelines and developer workstations executing projen-generated tasks

Discovery Timeline

• 2026-09-11 - CVE-2026-89066 published to the National Vulnerability Database (NVD)
• 2026-09-11 - Last updated in NVD database
• Referenced advisories: AWS Security Bulletin 2026-108, GitHub Projen Release v0.103.0, and GitHub Security Advisory GHSA-q6g4-h6vc-vqm8

Technical Details for CVE-2026-89066

Vulnerability Analysis

projen synthesizes project files, including a task manifest at .projen/tasks.json, from a developer-authored configuration. During synthesis, projen interpolates string values from project configuration and from filesystem entries such as repository file names into shell commands stored in the generated task definitions. The synthesis path does not neutralize shell metacharacters such as ;, |, &&, backticks, or $(...) command substitution. Any interpolated value that reaches a task command inherits full shell semantics when the task is later executed by projen or downstream runners.

Execution occurs in the local user context, which typically maps to a developer workstation or a CI runner with repository, credential, and cloud access. The injected payload runs with the privileges of the process invoking the task.

Root Cause

The root cause is missing sanitization in the task synthesis component when constructing shell command strings from untrusted inputs. Configuration values and repository file names are concatenated into command definitions without escaping or argv-style separation, allowing shell metacharacters to break out of the intended argument context [CWE-78].

Attack Vector

An attacker supplies a crafted project configuration value or introduces a repository file whose name contains shell metacharacters. When a maintainer runs projen synthesis, the malicious payload is embedded into .projen/tasks.json. Because the generated manifest is committed to the repository, the injection persists across clones. Any developer or CI runner that subsequently executes the affected task triggers command execution. Exploitation requires user action to invoke the task but does not require elevated privileges.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-q6g4-h6vc-vqm8 for technical details.

Detection Methods for CVE-2026-89066

Indicators of Compromise

• Unexpected shell metacharacters (;, |, &&, `, $(...)) inside command strings in .projen/tasks.json
• Repository files whose names contain shell metacharacters or command substitution syntax
• Unusual outbound network connections or child processes spawned from projen or npx projen invocations on developer or CI hosts

Detection Strategies

• Audit .projen/tasks.json across repositories for command entries containing metacharacters or nested command substitution
• Compare pre- and post-synthesis diffs of .projen/tasks.json in pull requests to flag anomalous command mutations
• Inspect CI logs for projen task steps that spawn unexpected child processes such as curl, wget, sh -c, or reverse-shell utilities

Monitoring Recommendations

• Enable process-lineage telemetry on developer workstations and CI runners to capture child processes of node, npm, and projen
• Alert on new or modified files under .projen/ in code review workflows and pre-merge checks
• Correlate credential access events (cloud CLI, git credential helper) with recent projen task executions

How to Mitigate CVE-2026-89066

Immediate Actions Required

• Upgrade projen to version 0.103.0 or later across all repositories and CI images
• Re-synthesize each project after upgrading so .projen/tasks.json is regenerated with sanitized task definitions
• Commit the regenerated .projen/tasks.json; upgrading alone is insufficient because the vulnerable file is committed to the repository
• Review historical commits for suspicious modifications to .projen/tasks.json or file names containing shell metacharacters

Patch Information

The fix ships in projen 0.103.0. See the GitHub Projen Release v0.103.0 notes and the GitHub Security Advisory GHSA-q6g4-h6vc-vqm8 for remediation guidance. AWS has published complementary guidance in AWS Security Bulletin 2026-108.

Workarounds

• Restrict who can modify projen configuration files and repository contents that feed synthesis inputs
• Reject repository file names containing shell metacharacters through pre-commit hooks or server-side push rules
• Run projen synthesis and generated tasks inside ephemeral, least-privilege containers without long-lived cloud credentials until the upgrade is completed

# Upgrade projen and regenerate the task manifest
npm install --save-dev projen@^0.103.0
npx projen
git add .projen/tasks.json
git commit -m "chore: regenerate .projen/tasks.json for CVE-2026-89066"