https://vulnerability.circl.lu/sightings/feed 2026-08-15T18:35:51.422921+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/45aa7f12-d243-4c0d-b988-44ed08f9b878/export 2026-08-15T18:35:51.435701+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "45aa7f12-d243-4c0d-b988-44ed08f9b878", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wcx4-wpfv-mc5c", "type": "seen", "source": "https://gist.github.com/alon710/990635ffdd01b8358cf96c18cad137b7", "content": "# CVE-2026-15895: CVE-2026-15895: OS Command Injection in AWS jsii-diff CLI\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-15895\n\n## Summary\nAn OS command injection vulnerability exists in the npm package loading component of the jsii-diff CLI tool within the AWS jsii framework. Prior to version 1.131.0, when parsing package specifiers prefixed with `npm:`, the tool concatenated user-controlled inputs directly into a shell execution string via child_process.exec. This allows attackers to execute arbitrary shell commands under the context of the running Node.js process.\n\n## TL;DR\nUnsanitized input interpolation in jsii-diff's NPM package downloader allows local or pipeline-integrated attackers to execute arbitrary shell commands via crafted package names prefixed with npm:.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A)\n- **CVSS Score**: 8.4\n- **EPSS Score**: 0.0063\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- AWS jsii-diff (< 1.131.0)\n- **jsii-diff**: < 1.131.0 (Fixed in: `1.131.0`)\n\n## Mitigation\n\n- Upgrade jsii-diff to version 1.131.0 or later.\n- Validate all package-name parameters against a strict alphanumeric allowlist prior to execution.\n- Incorporate --ignore-scripts in npm configurations to prevent remote package lifecycle execution.\n\n**Remediation Steps:**\n1. Identify any global or local installations of jsii-diff using `npm list -g jsii-diff` or inspecting package.json.\n2. Update global instances via `npm install -g jsii-diff@latest`.\n3. Update project dependencies to ensure `jsii-diff` version >= 1.131.0 is used.\n4. Verify the installation by running `jsii-diff --version`.\n\n## References\n\n- [NVD - CVE-2026-15895](https://nvd.nist.gov/vuln/detail/CVE-2026-15895)\n- [CVE Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-15895)\n- [AWS Security Bulletin](https://aws.amazon.com/security/security-bulletins/2026-057-aws/)\n- [GitHub Release Notes](https://github.com/aws/jsii/releases/tag/v1.131.0)\n- [Remediation Patch Commit](https://github.com/aws/jsii/commit/9f42f274b23e80dd38dce51d0e8847149fcf2528)\n- [AWS jsii-diff Release Commit](https://github.com/aws/jsii/commit/c0a3f35b59af17d8fe4a92292e099fbb08b8ac3c)\n- [GitHub Advisory Database](https://github.com/advisories/GHSA-wcx4-wpfv-mc5c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-15895) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T07:36:05.523818Z"} 2026-08-08T07:36:05.523818+00:00