CVE-2026-11417: OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

Synopsis

OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib allows an attacker who controls one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to inject shell metacharacters and run arbitrary commands on the host executing the CDK toolchain. The attack requires local access to the host and a low-privilege account, plus a user action to trigger the bundling pipeline, but no special privilege escalation beyond that. Successful exploitation gives the attacker full read, write, and crash capabilities against the host process. A patched-image rebuild at aws-cdk-lib 2.245.0 (2.246.0 on Windows) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host running the CDK toolchain; no network-facing service is exposed.

• AuthenticationRequired

  Any low-privilege account on the host is sufficient; no admin or elevated credentials are required.

• Victim interactionRequired

  A user must trigger the NodejsFunction bundling pipeline (for example, by running a CDK synth or deploy command) for the injected shell metacharacters to execute.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker controls at least one of the affected bundling properties; no race conditions or special memory layout are required.

Blast Radius

• Reads files and environment variables accessible to the CDK toolchain process, including credentials, secrets, and source code on the build host.
• Writes or overwrites files on the host, enabling persistence mechanisms or corruption of build artifacts.
• Executes arbitrary processes under the identity of the CDK toolchain user, allowing lateral movement within the build environment.
• Crashes or disrupts the CDK toolchain process, blocking infrastructure deployments.