An authenticated attacker who can manipulate component schemas via the AWS Amplify Studio interface or the create-component CLI command can inject arbitrary JavaScript expressions. These expressions are executed during the component rendering and build phases. Because these processes often run in the context of the user's build environment or automated CI/CD pipelines, this flaw could lead to unauthorized code execution, potential exfiltration of environment secrets, or further compromise of the development infrastructure. Users are advised to upgrade to version 2.20.4 or later to remediate this issue.

Impact

Successful exploitation allows for arbitrary code execution within the build environment of applications utilizing AWS Amplify Studio. This could lead to a compromise of CI/CD pipeline integrity, unauthorized access to build-time secrets, or the injection of malicious code into the final application frontend. The vulnerability impacts any organization using amplify-codegen-ui versions <= 2.20.2 for generating component files.

Recommendation

• Upgrade amplify-codegen-ui and @aws-amplify/codegen-ui-react packages to version 2.20.4 or higher immediately to address CVE-2025-4318.
• Audit CI/CD pipelines and AWS Amplify Studio component schemas for unauthorized modifications or suspicious expression patterns introduced by unexpected users.
• Review access control policies for AWS Amplify Studio to restrict component creation and modification capabilities to verified administrators.