Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417

Metadata

Affected Target

Summary

The AWS CDK NodejsFunction construct bundles Lambda handlers with esbuild during cdk synth, and prior to 2.245.0 it built the esbuild invocation by directly interpolating several user/construct-controlled properties (externalModules, loader, define, inject, esbuildArgs) into a single shell command string that was then executed via bash -c / cmd /c. Because none of these properties were sanitized for shell metacharacters, a value such as foo & echo PWNED > pwned.txt placed in externalModules would split the command and execute the attacker’s payload as a second, independent shell command. This made it possible for a malicious or compromised third-party CDK construct (published to npm or submitted via PR) to achieve arbitrary command execution on any machine that ran cdk synth, entirely bypassing install-time defenses like npm audit or --ignore-scripts since the injection fires at synthesis time rather than install time. The included PoC is a minimal CDK app that sets a poisoned externalModules entry and confirms RCE by checking for a marker file written by the injected command.

Vulnerability Details

Root Cause

bundling.ts in aws-cdk-lib’s aws-lambda-nodejs module joined an array of esbuild CLI arguments (some built from unsanitized construct properties) into a single string and passed it to bash -c / cmd /c, allowing shell metacharacters (&, ;, |, backticks, $()) in those properties to be interpreted by the shell.

Attack Vector

1. Attacker publishes (or contributes via PR) a CDK construct/npm package that wraps NodejsFunction and sets an externalModules/loader/define/inject/esbuildArgs value containing shell metacharacters and a payload command.
2. A developer imports the construct and runs cdk synth (or cdk deploy, which synths first) locally or in CI/CD.
3. CDK builds the esbuild bundling command by string concatenation and executes it via a shell, causing the injected payload (e.g. exfiltrating ~/.aws/credentials) to run alongside the legitimate esbuild invocation.
4. Attacker collects exfiltrated data or achieves further code execution on the build host.

Impact

Arbitrary OS command execution on any developer machine or CI/CD runner performing CDK synthesis, enabling theft of AWS credentials, source code, or further pipeline compromise.

Environment / Lab Setup

Target:   aws-cdk-lib 2.244.0 (pre-patch) via a local CDK TypeScript project
Attacker: Node.js 18/20, npm, ts-node, aws-cdk-lib, constructs, esbuild

Proof of Concept

PoC Script

See poc/app.ts, poc/lambda/handler.ts, and poc/package.json in this folder.

1
2
3
4

cd poc
npm install
npm run poc   # runs `ts-node app.ts`
cat ../pwned.txt

app.ts defines a NodejsFunction whose bundling.externalModules contains foo & echo CVE-2026-11417 PWNED > ../pwned.txt. Running CDK synthesis on the vulnerable aws-cdk-lib version triggers the injected echo command, writing pwned.txt in the parent directory to confirm command execution.

Detection & Indicators of Compromise

Signs of compromise:

• Unexplained files or network callouts appearing during cdk synth/cdk deploy runs
• CI/CD logs showing esbuild invocations followed by unrelated shell commands (curl, cat ~/.aws/credentials, etc.)
• Newly introduced or updated third-party CDK constructs with unusual bundling configuration values

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/HeshamASH/CVE-2026-11417-AWS-CDK-RCE on 2026-07-05.