Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

AWS jsii-diff: Malicious Package Installation

published 3 months ago

Summary

An outdated version of AWS jsii-diff can allow attackers to execute arbitrary system commands if they trick the system into installing a malicious package. This is a serious issue because it can lead to unauthorized access and data theft. To protect your system, please update to the latest version of jsii-diff, which is version 1.131.0 or later.

What to do

Update aws-cdk-team jsii-diff to version 1.131.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	aws-cdk-team	jsii-diff	< 1.131.0 Fix: upgrade to 1.131.0

Original advisory text

Duplicate Advisory: Command Injection in jsii-diff via npm: package argument

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wcx4-wpfv-mc5c. This link is maintained to preserve external references.

### Original Description
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.

To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.4 High

Type

CWE-78OS Command Injection

Timeline

Published15 Jul 2026

Updated7 Aug 2026

First seen7 Aug 2026

Sources

GHSA-h738-vh6g-q8gh · GHSA

Track software like this

Free during beta