CVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-lib
Cdk Lib ยท 2026-10-19
Actions
Technical Details
| Affected Versions | < 2.260.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-13760 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the aws-cdk-lib to version 2.260.0 and ensure that all dependency version strings in package.json come from trusted sources to address the OS command injection vulnerability (CVE-2026-13760).
For Platform Teams
Adopt the latest aws-cdk-lib version 2.260.0 to incorporate the security fixes and ensure the platform's resilience against potential OS command injection attacks.
For Executives
Implement the upgrade to aws-cdk-lib version 2.260.0 to mitigate the risk of OS command injection and ensure the security of cloud infrastructure defined using AWS CDK.