An OS command injection flaw exists in the NodejsFunction local bundling pipeline of the AWS Cloud Development Kit library. When the value of one or more bundling properties—including externalModules, define, loader, inject, or esbuildArgs—is controlled by an adversary, the CDK build process can subject those values to the shell, allowing arbitrary command execution. The vulnerability is a classic command injection flaw (CWE-78) that can compromise the host environment if the CDK tool runs with elevated privileges.

The issue affects the AWS Cloud Development Kit library on all platforms for versions prior to 2.245.0, and on Windows for versions prior to 2.246.0. Users of older aws-cdk-lib releases should verify their current version and plan an upgrade accordingly.

The CVSS score of 7 indicates a moderate severity. While an EPSS score is not available, the lack of a KEV listing and the local nature of the vulnerability suggest a lower exploitation likelihood. An attacker must be able to inject values into the bundling configuration of a CDK application, a condition typically limited to developers or build pipelines with access to the source. However, once achieved, the attacker can execute shell commands on the CDK host with the same privileges as the user running the tool.