This vulnerability (CWE-95) in AWS Amplify Studio's UI component property expressions allows insufficient input validation, enabling authenticated users with limited privileges to inject and execute arbitrary JavaScript code during the component rendering and build process. This can lead to high-impact consequences due to the execution of malicious code within the Amplify Studio environment. The vulnerability affects version 0.1.0 of the aws-amplify/amplify-codegen-ui package. AWS, as the cloud service provider, manages the remediation and has released an official fix.

An authenticated user with permissions to create or modify components can exploit this vulnerability to execute arbitrary JavaScript code during component rendering and build. This can compromise the integrity and security of the build process, potentially leading to unauthorized actions or code execution within the Amplify Studio environment. The vulnerability is rated critical with a CVSS 4.0 score of 9, reflecting high attack vector, complexity, and impact metrics.

AWS manages remediation for this cloud-hosted service and has released an official fix. Users should refer to the AWS security bulletin (https://aws.amazon.com/security/security-bulletins/AWS-2025-010/) for detailed guidance and ensure their Amplify Studio environment is updated accordingly. No additional user action is required beyond applying the vendor's fix or updates as managed by AWS.