Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an OS command injection in the NodejsFunction local bundling feature of aws-cdk-lib. The root cause is the construction of a shell command string using unsanitized user input, which is then executed in a shell.
The analysis of the patch commits reveals two key functions involved in the vulnerability:
Bundling.createBundlingCommand: This function was responsible for creating the esbuild command string. It took several bundling options that could be controlled by a user (e.g., externalModules, define, esbuildArgs) and concatenated them into a single string. Because the inputs were not escaped, an attacker could provide input with shell metacharacters (e.g., '; ls -la') to inject arbitrary commands.
Bundling.getLocalBundlingProvider: This function returned the tryBundle method which performed the local bundling. The tryBundle method would call createBundlingCommand to get the command string and then execute it using exec with a shell (bash -c on Linux/macOS and cmd /c on Windows). This shell execution is what allowed the injected commands to run.
The patch addresses this vulnerability by completely removing the shell-based execution for the main bundling command. It refactors the code to build an array of arguments for esbuild and then uses spawnSync to execute the command directly, without involving a shell. This prevents any shell metacharacters in the input from being interpreted as commands.
Bundling.createBundlingCommandpackages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts
Bundling.getLocalBundlingProviderpackages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aws-cdk-lib | npm | < 2.246.0 | 2.246.0 |