aws-cdk-lib vulnerabilities
CVEs whose affected-version data names the aws-cdk-lib package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-107608Medium· 5.5Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To rem…
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To rem…
▾ SunlitAWS · aws-cdk-libEPSS 0.14%via NVD
GHSA-464c-974j-9xm6Low· 3.3AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
▾ Sunlitaws-cdk-lib · aws-cdk-libvia OSV
CVE-2026-13760High· 7.3aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
▾ Twilightaws-cdk-lib · aws-cdk-libEPSS 1.2%via GHSA
CVE-2026-11417High· 7.3PoCaws-cdk-lib: OS Command Injection in NodejsFunction Bundling
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
▾ Midnightaws-cdk-lib · aws-cdk-libEPSS 0.99%via GHSA