This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) within the startup script of SageMaker Spaces in AWS SageMaker Unified Studio. The startup script validates network connections but fails to properly sanitize connection details, enabling an attacker with project contributor or higher permissions to execute arbitrary code in another member's Space. When Trusted Identity Propagation is enabled, this can escalate privileges by exposing temporary execution role credentials, allowing unauthorized calls to trusted AWS services. AWS has released patches for multiple sagemaker-distribution version branches, and the fix is automatically applied on the next startup for supported versions.

Successful exploitation can lead to arbitrary code execution within another project member's SageMaker Space, potentially resulting in unauthorized access to temporary execution role credentials. This enables attackers to invoke downstream AWS services with elevated privileges, compromising confidentiality, integrity, and availability of resources. The vulnerability has a CVSS 3.1 score of 9.0 (critical), indicating high severity with network attack vector, low attack complexity, and requiring privileges but allowing significant impact.

AWS has implemented an official fix that sanitizes connection details during the startup validation process. This fix is deployed globally and automatically applies to all supported SageMaker Spaces on their next startup. Users should upgrade to the fixed versions: 2.14.12 or later for the 2.14.x branch, 3.9.12 or later for the 3.9.x branch, 4.0.11 or later for 4.0.x, 4.1.11 or later for 4.1.x, 4.2.8 or later for 4.2.x, 4.3.5 or later for 4.3.x, and 4.4.3 or later for 4.4.x. Versions 2.8.x, 2.13.x, 3.3.x, and 3.8.x are end-of-support and remain unpatched. No additional mitigation is required beyond applying these updates.