AWS identified two security issues in projen, an open-source project configuration tool. CVE-2026-89065 involves a relative path traversal vulnerability in the file manifest cleanup component in versions before 0.101.37, which could allow context-dependent attackers to recursively delete files and directories outside the project directory via crafted entries in the version-controlled generated file manifest (.projen/files.json). The fix is automatically applied by the projen runtime from version 0.101.37 onward. CVE-2026-89066 is an OS command injection vulnerability in the task synthesis component in versions before 0.103.0. This flaw allows context-dependent attackers to execute arbitrary OS commands on developer workstations or CI runners by injecting shell metacharacters into project configuration values or repository file names that are interpolated into generated task definitions (.projen/tasks.json). The fix in version 0.103.0 requires upgrading and re-synthesizing the project to regenerate the corrected task definitions. Both vulnerabilities require upgrading to the fixed versions to mitigate the risks.

CVE-2026-89065 could allow attackers with the ability to influence the generated file manifest to delete files and directories outside the intended project scope, potentially causing data loss or disruption. CVE-2026-89066 could enable attackers to execute arbitrary OS commands on developer machines or CI environments, potentially leading to full system compromise or unauthorized actions. Both vulnerabilities depend on context and attacker ability to influence project configuration or version-controlled files. No known exploits in the wild have been reported.

For CVE-2026-89065, upgrade projen to version 0.101.37 or later; this fix is automatically applied by the runtime and re-synthesis is not required. Additionally, review the version control history of .projen/files.json for any entries that escape the project directory and remove them before running projen. For CVE-2026-89066, upgrade projen to version 0.103.0 or later and re-synthesize your project to regenerate the .projen/tasks.json file with corrected task definitions. Audit project configuration values and repository file names for shell metacharacters and remove or escape them prior to running projen. Upgrading alone is insufficient without re-synthesis due to the committed generated task definitions. It is recommended to upgrade to the latest projen version and ensure any derivative code incorporates these fixes.