# CVE-2026-13760: OS Command Injection in aws-cdk-lib Docker Bundling

> CVE-2026-13760: OS Command Injection in aws-cdk-lib Docker Bundling. CVSS 7.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-13760
Last updated: 2026-10-25T16:10:00Z

- Published: 2026-07-01 19:05 UTC · Updated: 2026-10-25 16:10 UTC · Assigner: AMZN
- CVSS: 7.3 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS: 1.2%, 67th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-78

## Description

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. To remediate this issue, users should upgrade to v2.260.0.

## Affected vendors and products

- AWS: AWS CDK

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-13760)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13760)
- [https://aws.amazon.com/security/security-bulletins/2026-050-aws/](https://aws.amazon.com/security/security-bulletins/2026-050-aws/)
- [https://github.com/aws/aws-cdk/releases/tag/v2.260.0](https://github.com/aws/aws-cdk/releases/tag/v2.260.0)
- [https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf](https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-13760 · Markdown: https://rewindex.com/cve/CVE-2026-13760.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-13760 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:22.246Z