{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/aws-cdk-lib/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-13760"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["aws-cdk-lib"],"_cs_severities":["high"],"_cs_tags":["command-injection","supply-chain","cloud-native","aws-cdk","vulnerability"],"_cs_type":"advisory","_cs_vendors":["AWS"],"content_html":"\u003cp\u003eA high-severity OS command injection vulnerability, CVE-2026-13760, has been identified in the \u003ccode\u003eaws-cdk-lib\u003c/code\u003e package of the AWS Cloud Development Kit (CDK) framework, affecting versions prior to 2.260.0. This flaw allows an actor to execute arbitrary commands on the host system running the CDK toolchain if they can control dependency version strings in a project's \u003ccode\u003epackage.json\u003c/code\u003e file. The vulnerability specifically impacts Docker-based Lambda bundling when the \u003ccode\u003enodeModules\u003c/code\u003e option is specified. During this process, \u003ccode\u003eNodejsFunction\u003c/code\u003e constructs a shell command string using module version strings without proper sanitization. An attacker can leverage this by embedding shell metacharacters in a controlled version string, leading to command execution within the bundling container. Since the container has read/write bind mounts to the host filesystem, this effectively grants the attacker arbitrary code execution on the host with the privileges of the user executing \u003ccode\u003ecdk synth\u003c/code\u003e, \u003ccode\u003ecdk deploy\u003c/code\u003e, or \u003ccode\u003ecdk diff\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains control over dependency version strings in a project's \u003ccode\u003epackage.json\u003c/code\u003e file, potentially via a compromised or untrusted npm package referenced through \u003ccode\u003enodeModules\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker inserts shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e) into one of the controlled dependency version strings.\u003c/li\u003e\n\u003cli\u003eA developer or CI/CD pipeline uses \u003ccode\u003eaws-cdk-lib\u003c/code\u003e with \u003ccode\u003eNodejsFunction\u003c/code\u003e and Docker-based bundling, with the \u003ccode\u003enodeModules\u003c/code\u003e option specified, to deploy their cloud infrastructure.\u003c/li\u003e\n\u003cli\u003eDuring the bundling process, the CDK toolchain processes the \u003ccode\u003epackage.json\u003c/code\u003e file to assemble a shell command string for operations inside the Docker container.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eNodejsFunction\u003c/code\u003e's internal \u003ccode\u003eOsCommand\u003c/code\u003e helper interpolates the malicious dependency version string into the shell command without proper escaping.\u003c/li\u003e\n\u003cli\u003eThe bundling container executes the crafted shell command via \u003ccode\u003ebash -c\u003c/code\u003e, which interprets the injected shell metacharacters as distinct commands.\u003c/li\u003e\n\u003cli\u003eArbitrary commands specified by the attacker are executed within the bundling container, leveraging its access to the host filesystem via read/write bind mounts.\u003c/li\u003e\n\u003cli\u003eThe injected commands execute on the host machine, typically with the privileges of the user who initiated the \u003ccode\u003ecdk synth\u003c/code\u003e, \u003ccode\u003ecdk deploy\u003c/code\u003e, or \u003ccode\u003ecdk diff\u003c/code\u003e command.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-13760 allows an attacker to achieve arbitrary code execution on the developer's workstation or CI/CD environment where the AWS CDK toolchain is executed. This can lead to complete compromise of the build environment, exfiltration of sensitive source code, AWS credentials, or other intellectual property. The attacker gains the privileges of the user running the \u003ccode\u003ecdk\u003c/code\u003e commands, which can often be elevated, posing a significant supply chain risk. While no specific victim counts or sectors are mentioned, any organization using \u003ccode\u003eaws-cdk-lib\u003c/code\u003e with Docker-based bundling and susceptible to untrusted \u003ccode\u003epackage.json\u003c/code\u003e dependency version string manipulation is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eaws-cdk-lib\u003c/code\u003e to version 2.260.0 or later immediately to patch CVE-2026-13760.\u003c/li\u003e\n\u003cli\u003eAudit all third-party constructs and dependencies in your \u003ccode\u003epackage.json\u003c/code\u003e to ensure the modules listed in the \u003ccode\u003enodeModules\u003c/code\u003e bundling option and their version strings come only from trusted sources.\u003c/li\u003e\n\u003cli\u003eConsider using local bundling instead of Docker-based bundling for \u003ccode\u003eNodejsFunction\u003c/code\u003e where feasible, as this bypasses the affected code path.\u003c/li\u003e\n\u003cli\u003eEnsure that any forked or derivative codebases incorporating \u003ccode\u003eaws-cdk-lib\u003c/code\u003e are also updated to address CVE-2026-13760.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:09:16Z","date_published":"2026-07-21T19:09:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-os-command-injection-aws-cdk-lib/","summary":"An OS command injection vulnerability, CVE-2026-13760, in AWS CDK's `aws-cdk-lib` package before version 2.260.0 allows an attacker to execute arbitrary commands on the host running the CDK toolchain by injecting shell metacharacters into dependency version strings within a project's `package.json` file when using Docker-based NodejsFunction bundling.","title":"OS Command Injection in AWS CDK NodejsFunction Docker Bundling (CVE-2026-13760)","url":"https://feed.craftedsignal.io/briefs/2026-07-os-command-injection-aws-cdk-lib/"}],"language":"en","title":"CraftedSignal Threat Feed - Aws-Cdk-Lib","version":"https://jsonfeed.org/version/1.1"}