CVE-2026-18245

Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Published Jul 30, 2026 CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318.

To remediate this issue, users should upgrade to version 2.20.6

Analysis

Technical impact

The vulnerability in Amazon @aws-amplify/codegen-ui-react arises from insufficient input validation of Studio component or theme schema values. This code injection flaw allows a remote authenticated user to inject and execute arbitrary JavaScript in end‑user browsers, developer workstations, CI/CD pipelines, and server‑side rendering contexts, effectively granting the attacker control over the execution environment. The weakness is identified as CWE‑94, confirming a code injection vulnerability.

Affected Systems

Affected systems include AWS Amplify Codegen UI React, specifically any installation of the library prior to version 2.20.6. Versions 2.20.6 and later incorporate a fix that expands input validation for Studio schemas.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is <1% (0.00522), indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The intended attack requires a remote authenticated user to supply a maliciously crafted schema—an action that is feasible for users with legitimate editing rights or compromised credentials. While no confirmed exploitation reports are available, the combination of automated contexts (CI/CD, SSR) and a code injection vector warrants proactive remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AWS

Amplify Codegen UI

unaffected

Version	Status	Constraints
`0`	affected	< 2.20.6

Configuration 1 [-]

cpe:2.3:a:amazon:amplify_codegen_ui:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Aws

Amplify Codegen Ui

Version	Status	Scheme	Platform
`[0,2.20.6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Amplify Codegen UI React version 2.20.6 or later to apply the fixed input validation logic.
Review and sanitize all existing Studio component and theme schema values to ensure they contain no JavaScript payloads or unexpected code fragments.
Limit or audit the permissions of users who can modify schema values, and monitor for unauthorized changes in CI/CD or server‑side environments.

Generated by OpenCVE AI on August 4, 2026 at 11:41 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.987% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-066-aws/
https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.6
https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-74xx-rjgf-m69j

History

Jul 30, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 30, 2026 6:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6
Title		Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react
First Time appeared		Aws Aws amplify Codegen Ui
Weaknesses		CWE-94
CPEs		cpe:2.3:a:aws:amplify_codegen_ui::::::::
Vendors & Products		Aws Aws amplify Codegen Ui
References		https://aws.amazon.com/security/security-bulletins/2026-066-aws/ https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.6 https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-74xx-rjgf-m69j
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 6.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H'}`