DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-15895: CVE-2026-15895: OS Command Injection in AWS jsii-diff CLI

#security #cve #cybersecurity

CVE-2026-15895: OS Command Injection in AWS jsii-diff CLI

Vulnerability ID: CVE-2026-15895
CVSS Score: 8.4
Published: 2026-08-07

An OS command injection vulnerability exists in the npm package loading component of the jsii-diff CLI tool within the AWS jsii framework. Prior to version 1.131.0, when parsing package specifiers prefixed with npm:, the tool concatenated user-controlled inputs directly into a shell execution string via child_process.exec. This allows attackers to execute arbitrary shell commands under the context of the running Node.js process.

TL;DR

Unsanitized input interpolation in jsii-diff's NPM package downloader allows local or pipeline-integrated attackers to execute arbitrary shell commands via crafted package names prefixed with npm:.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Local (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A)
  • CVSS Score: 8.4
  • EPSS Score: 0.0063
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • AWS jsii-diff (< 1.131.0)
  • jsii-diff: < 1.131.0 (Fixed in: 1.131.0)

Code Analysis

Commit: 9f42f27

Fix command injection in npm source parsing within jsii-diff utility.

Exploit Details

  • Advisory: Command injection payload demonstration in security advisory details.

Mitigation Strategies

  • Upgrade jsii-diff to version 1.131.0 or later.
  • Validate all package-name parameters against a strict alphanumeric allowlist prior to execution.
  • Incorporate --ignore-scripts in npm configurations to prevent remote package lifecycle execution.

Remediation Steps:

  1. Identify any global or local installations of jsii-diff using npm list -g jsii-diff or inspecting package.json.
  2. Update global instances via npm install -g jsii-diff@latest.
  3. Update project dependencies to ensure jsii-diff version >= 1.131.0 is used.
  4. Verify the installation by running jsii-diff --version.

References

Read the full report for CVE-2026-15895 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)