high · 7.8CVE-2026-15895Aug 7, 2026

CVE-2026-15895: jsii-diff OS Command Injection via npm: Package Argument

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

jsii-diff passes user-supplied npm package specifiers directly to a shell command without sanitization, letting anyone who controls its arguments run arbitrary OS commands.

Packagejsii-diff
Ecosystemnpm
Affected< 1.131.0
Fixed in1.131.0
CVE-2026-15895: jsii-diff OS Command Injection via npm: Package Argument

The problem

jsii-diff accepts an argument of the form npm:<package-specifier> to download and compare a package from the npm registry. The package-specifier portion is passed unsanitized into a shell invocation (execSync or equivalent), meaning shell metacharacters in that string are interpreted by the OS.

Anyone who controls the CLI arguments, such as a CI pipeline that builds the specifier from an untrusted source, can inject arbitrary commands. The injected commands run with the same OS-level permissions as the jsii-diff process itself.

Proof of concept

A working proof-of-concept for CVE-2026-15895 in jsii-diff, with the exact payload below.

bash
jsii-diff "npm:lodash; touch /tmp/pwned" .

The tool strips the npm: prefix and interpolates the remainder directly into a shell string, so the semicolon terminates the npm command and starts a new one. The patch (commit 1e3606c, PR #5118) eliminates shell interpolation entirely: the package specifier is now passed as a discrete argument to the child process (spawn-style), so shell metacharacters are never interpreted.

CWE-78 applies because user-controlled input reached a shell execution sink without escaping or allowlist validation.

The fix

Upgrade jsii-diff to version 1.131.0 or later. If an immediate upgrade is not possible, ensure only trusted actors can supply arguments to jsii-diff, particularly in CI/CD pipelines that construct the npm: specifier from external input.

Reported by AWS Security.

References: [1][2][3][4][5]

Related research