AWS CDK (aws-cdk-lib) before version 2.260.0 contains an OS command injection vulnerability (CVE-2026-13760) in the NodejsFunction Docker bundling pipeline. An attacker who can control dependency version strings in a package.json file used by the project can inject shell metacharacters that are executed on the host system running the CDK toolchain. This vulnerability arises from unsafe processing of these version strings by the OsCommand helper during Docker-based bundling when nodeModules is specified. The vulnerability requires the attacker to have control over the dependency version strings processed during bundling. The issue has been addressed in aws-cdk-lib version 2.260.0.

An attacker with the ability to control dependency version strings in a package.json file can execute arbitrary OS commands on the host running the AWS CDK toolchain during Docker-based bundling. This could lead to unauthorized command execution on the host system. The impact is limited by the prerequisite that the attacker must control the dependency version strings processed during bundling.

Upgrade aws-cdk-lib to version 2.260.0 or later, which contains the official fix for this vulnerability. As a workaround, ensure that all modules and their version strings in the package.json file come from trusted sources to prevent injection of malicious content. Alternatively, use local bundling instead of Docker-based bundling to avoid the affected code path. The recommended remediation is to upgrade to the fixed version.