CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK

Amazon CodeCatalyst blueprints are reusable project templates built on the open source @amazon-codecatalyst/blueprints.blueprint npm package. In versions before 0.3.156, the blueprint resynthesis framework reads the .ownership-file to determine modifiable files. The owner field of a [local] merge strategy entry was passed unsanitized to an OS shell command, enabling OS command injection if a user with commit rights inserted shell metacharacters. This could lead to arbitrary command execution with the privileges of the resynthesis environment. The Amazon CodeCatalyst service mitigates risk by running resynthesis in isolated per-project environments with scoped credentials and server-side validation that rejects unsafe commands, even for vulnerable blueprint versions. The vulnerability is resolved in version 0.3.156 by eliminating shell interpretation of the owner field and enforcing an allowlist of commands.

A user with commit permissions to a repository using affected blueprint versions (<= 0.3.155) could execute arbitrary OS commands during the resynthesis process by injecting shell metacharacters into the owner field of the .ownership-file. This could compromise the environment performing resynthesis with the privileges and credentials available there. However, the Amazon CodeCatalyst service itself is not impacted due to isolated execution environments and server-side validation that blocks unsafe commands. There are no known exploits in the wild.

Upgrade to @amazon-codecatalyst/blueprints.blueprint version 0.3.156 or later, which removes shell interpretation of the owner field and enforces an allowlist on commands to eliminate command injection. For users of the Amazon CodeCatalyst service, no action is required because the service applies server-side validation and runs resynthesis in isolated environments that prevent exploitation. Ensure any forked or derivative code is also updated to incorporate these fixes.