CVE-2026-13760: AWS CDK Docker Bundling Command Injection (aws-cdk-lib <2.260.0)

Technical summary

The vulnerability exists in the OsCommand helper within the Node.js Docker bundling pipeline of aws-cdk-lib. During Docker-based bundling operations where nodeModules are specified, dependency version strings from package.json are passed to the OsCommand helper without proper sanitization. Shell metacharacters in these version strings are not escaped, allowing command injection. An attacker controlling the package.json dependency version field can inject arbitrary shell commands that execute on the host machine running the CDK synthesis process. The attack surface is limited to local or repository-level access, but the impact is severe because the CDK toolchain often runs with developer or CI/CD permissions.

Business impact

This vulnerability poses a supply-chain risk to development teams and CI/CD pipelines. If an attacker gains write access to your repository (or if a compromised dependency contains malicious package.json modifications), they can execute arbitrary code on the developer workstations or CI/CD runners performing CDK deployments. This could lead to credential theft, lateral movement into your AWS environment, injection of malicious infrastructure code, or compromise of build artifacts. Organizations using CDK for Infrastructure-as-Code are particularly exposed if they have weak access controls on repository write permissions or insufficient audit logging of package.json changes.

Affected systems

All versions of AWS aws-cdk-lib prior to 2.260.0 are affected across all platforms (Linux, macOS, Windows). The vulnerability only manifests when users employ Docker-based bundling for Node.js functions with the nodeModules option enabled—a common pattern for Lambda function packaging. Users who do not use Docker bundling or who do not specify nodeModules in their CDK stack definitions are unaffected.

Exploitability

Exploitability requires prior access to modify package.json dependency version strings in a project the attacker knows will be built with CDK and Docker bundling. This is not a remote exploit; it demands local filesystem access or repository write permissions. However, the barrier to exploitation is low once access is obtained—merely injecting shell metacharacters into a version string is trivial. The requirement for user interaction (running cdk synth or cdk deploy) is met in normal development and CI/CD workflows, making this a practical attack in compromised or insider-threat scenarios.

Remediation

Upgrade aws-cdk-lib to version 2.260.0 or later. This version contains fixes to the OsCommand helper that properly escape or sanitize shell metacharacters in dependency version strings. Additionally, restrict write access to package.json and other dependency manifests in your repositories, implement code review requirements for dependency changes, and monitor for unexpected modifications to package.json in your CI/CD logs.

Patch guidance

Apply aws-cdk-lib v2.260.0 or later by updating your package.json or dependency manager (npm, yarn, pnpm) and rebuilding your CDK application. If you use a monorepo or have multiple CDK projects, ensure all consume the patched version. Test CDK synthesis and deployment in a non-production environment after patching to confirm Docker bundling continues to work as expected. If you are locked to an earlier major version of CDK, verify with AWS whether a backport patch is available before considering a major version upgrade.

Detection guidance

Monitor package.json files for suspicious or unusual version strings that contain shell metacharacters (backticks, $(), |, &, ;, etc.) in dependency declarations. Audit CI/CD logs and developer machine logs for unexpected child process creation during cdk synth operations. If you suspect compromise, review recent changes to package.json and audit access logs to your source repository. Implement GitOps tooling that flags or blocks commits containing shell metacharacters in version fields. Monitor file integrity of package.json across your development infrastructure.

Why prioritize this

Although this vulnerability requires local or repository-level access and is not exploitable remotely, it scores HIGH (7.3) due to the combination of high impact (arbitrary code execution), low attack complexity, and the prevalence of CDK usage in AWS-centric organizations. Organizations with loose repository access controls, shared development machines, or supply-chain exposure should prioritize remediation. Those with strong access controls and separation of duties may deprioritize relative to remote exploits, but should still plan patching in a standard maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), requirement for low privilege/local user access (PR:L), user interaction required (UI:R, representing the need for the user to run CDK commands), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately penalizes the local-only nature of the attack but recognizes the severe post-exploitation impact. For organizations with strict repository access and isolated development environments, practical risk may be lower; for those with shared infrastructure or looser controls, practical risk may be higher.

Frequently asked questions