The vulnerability in Amazon @aws-amplify/codegen-ui-react arises from insufficient input validation of Studio component or theme schema values. This code injection flaw allows a remote authenticated user to inject and execute arbitrary JavaScript in end‑user browsers, developer workstations, CI/CD pipelines, and server‑side rendering contexts, effectively granting the attacker control over the execution environment. The weakness is identified as CWE‑94, confirming a code injection vulnerability.

Affected systems include AWS Amplify Codegen UI React, specifically any installation of the library prior to version 2.20.6. Versions 2.20.6 and later incorporate a fix that expands input validation for Studio schemas.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is <1% (0.00522), indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The intended attack requires a remote authenticated user to supply a maliciously crafted schema—an action that is feasible for users with legitimate editing rights or compromised credentials. While no confirmed exploitation reports are available, the combination of automated contexts (CI/CD, SSR) and a code injection vector warrants proactive remediation.