The vulnerability allows a user with the right to commit to a CodeCatalyst project to inject shell metacharacters into the owner field of a [local] merge strategy entry inside a crafted .ownership-file. This unsanitized input is passed to an operating system shell during blueprint resynthesis, giving the attacker the ability to execute arbitrary commands. The impact is limited to the isolated per‑project resynthesis environment.

Amazon Web Services CodeCatalyst blueprints SDK @amazon-codecatalyst/blueprints.blueprint versions earlier than 0.3.156 are affected. The vulnerability exists in the blueprint resynthesis framework bundled in these npm packages.

The CVSS base score is 8.5, indicating high severity. EPSS score of 2% indicates a low exploitation probability, but the risk of exploitation is non‑negligible given that the attacker only needs permission to commit changes to the repository. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely deliver the exploit via an .ownership-file commit. Resynthesis runs in an isolated per‑project environment with scoped credentials, and the service applies server‑side validation that rejects merge strategy commands outside a restricted allowlisted form, even for blueprint versions published before 0.3.156. Patch or upgrade is strongly recommended to eliminate the execution vector.