Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aws/aws-cdk
main @ 6a1934d
5
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Command Injection: 2 prior fixes. Scrutinize any change in this area.
@aws-cdk/aws-mediapackagev2-alpha: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Untrusted control over bundling properties, package versions, or local directory paths in NodejsFunction allows executing arbitrary commands on the host during local bundling. This is a critical risk when processing third-party dependencies or untrusted build specifications.
Command Injection: Direct interpolation of asset relative paths into shell environments during TarballImageAsset bundling leads to command execution risks if path names contain shell metacharacters.
Path Traversal: Improper prefix validation and incomplete path canonicalization during symlink verification allow external symlink targets to bypass boundary detection and escape intended asset boundaries.