The vulnerability arises from an improper neutralization of special elements within a template engine used by the publishing component of Amazon Virtual Engineering Workbench (VEW). A remote authenticated third party can craft a CloudFormation template body that contains malicious template engine directives. When the product versioning API processes this template, the publishing Lambda function executes the injected code with the permissions granted to its IAM role. This allows an attacker to run arbitrary code, potentially compromising all tenant projects and accessing data and resources beyond the intended scope.

Amazon Web Services' Virtual Engineering Workbench, a cloud-based engineering platform. No specific version ranges are disclosed in the official advisory, so any deployment of the VEW component that has not been updated to the latest release is potentially affected.

The CVSS score of 9.4 classifies this bug as Critical, indicating that exploitation would provide extensive capabilities. The EPSS score is not available, making it difficult to gauge current exploitation activity, yet the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires a remote authenticated user with access to the versioning API, so an attacker must first obtain credentials or social engineering success to submit the malicious template. Once authenticated, the exploitation path is straightforward: submit the malicious CloudFormation body, trigger the publishing lambda, and execute arbitrary code with the service’s IAM role. This gives the attacker broad access across tenant projects.