CVE-2026-115414High· 7.8▾ TwilightOS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host runn…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.
To remediate this issue, users should upgrade to version 1.166.2 or later.
aws-sam-cli >= 1.63.0 < 1.166.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104019Critical· 9.0OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before…
CVE-2026-87911Critical· 9.6An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a s…
CVE-2026-89066High· 7.8Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous int…
CVE-2025-3047Medium· 6.5AWS SAM CLI Path Traversal allows file copy to build container
CVE-2025-3048Medium· 6.5AWS SAM CLI Path Traversal allows file copy to local cache
CVE-2026-115417High· 7.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt