🎯 New Report #3637898: OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)
🔺Severity: High
👽 Reporter: kaporia
⭐️ Reputation: 104
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-03-30
⏰ Disclosed: 2026-07-06 17:48:30
📝 Summary: A vulnerability was discovered in the "aws-cdk-lib" NodejsFunction that allowed for OS command injection through the unsanitized "OsCommand" helper. The vulnerability was caused by the lack of proper escaping of user-controlled data when constructing shell commands during Docker-based bundling. This could have potentially led to arbitrary code execution within the Docker container, which had access to the host filesystem through bind mounts.
📂 Report JSON File: 3637898
@hackeronereports