An input sanitization flaw in the FileBrowser API of AWS Research and Engineering Studio permits a remote authenticated user to craft a request that causes the cluster‑manager EC2 instance to execute arbitrary shell commands, granting full remote code execution and compromising confidentiality, integrity, and availability of the affected environment. This defect corresponds to the Command Injection weakness identified by CWE‑78.

The vulnerability affects Amazon’s Research and Engineering Studio, versions 2024.10 through 2025.12.01. It exists within the FileBrowser functionality that operates on the cluster‑manager EC2 instance used by RES deployments.

The CVSS score of 7.7 indicates a high severity, while an EPSS score of less than 1% suggests that active exploitation in the wild is currently rare. The issue is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the RES API, meaning the attacker must possess user credentials with at least normal RES privileges. The typical attack path—sending a malicious request to the FileBrowser endpoint to trigger commands on the underlying EC2 instance—is inferred from the description.