CVE-2026-115414: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in AWS aws-sam-cli
Description
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an open-source framework for building serverless applications. We identified CVE-2026-115414, an OS command injection issue in the Terraform hook (sam build --hook-name terraform) in AWS SAM CLI. The Terraform hook generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters, which could allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build. Impacted versions: >=1.63.0, <=1.166.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
CVSS v3.1
Score 7.8high
Affected software
AWS
aws-sam-cli
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-78) exists in the Terraform hook component of AWS SAM CLI before version 1.166.2. An attacker capable of manipulating the Terraform configuration or plan file consumed during a build process can craft a Terraform resource address that leads to OS command injection. This results in arbitrary command execution with the privileges of the build user on the host running the build. The vulnerability has a CVSS 3.1 score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. AWS has published an advisory and fixed the issue in version 1.166.2.
Potential Impact
Successful exploitation allows arbitrary command execution as the build user on the host system running the build, potentially compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data manipulation, or disruption of build processes.
Mitigation Recommendations
Users should upgrade AWS SAM CLI to version 1.166.2 or later to remediate this vulnerability. Since this is a client-side tool, patching the software is the primary mitigation. No additional vendor-stated mitigations are provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-10-22T13:11:04.463Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-145-aws/","vendor":"AWS"}]
Threat ID: 6ada59f44d27ba8daa722194
Added to database: 10/22/2026, 18:46:12 UTC
Last enriched: 10/22/2026, 19:00:17 UTC
Last updated: 10/22/2026, 19:32:10 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.