Amazon Virtual Engineering Workbench: Arbitrary code execution via template engine (CVE-2026-119085)

Amazon Virtual Engineering Workbench (VEW) contains a vulnerability (CVE-2026-119085) in the template engine used within its publishing component. The flaw allows a remote authenticated user to supply a crafted CloudFormation template body containing malicious template engine directives through the product versioning API. Successful exploitation results in arbitrary code execution with the permissions of the publishing Lambda function's IAM role, potentially enabling unauthorized access to data and resources across all tenant projects.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the AWS Lambda IAM role associated with the publishing component. This may result in unauthorized access, modification, or exfiltration of sensitive data and resources across all tenant projects within the affected environment.

Recommendation

• Upgrade the Amazon Virtual Engineering Workbench deployment immediately by redeploying from the latest version available in the awslabs/virtual-engineering-workbench repository.
• Review IAM permissions associated with the publishing Lambda function to ensure the principle of least privilege is applied, limiting the impact of potential code execution.
• Audit logs for the product versioning API for requests containing unusual CloudFormation template bodies or template engine directive patterns.