This vulnerability (CVE-2026-89066) affects AWS projen prior to version 0.103.0. It involves improper neutralization of special elements used in OS commands (CWE-78), specifically in the task synthesis component. Attackers with context-dependent access can inject shell metacharacters via project configuration values and repository file names that are interpolated into generated task definitions, enabling arbitrary command execution on developer workstations or continuous integration runners. The issue is mitigated by upgrading to version 0.103.0 and re-synthesizing the project to regenerate the .projen/tasks.json file with corrected task definitions. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) with local attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation allows context-dependent attackers to execute arbitrary OS commands on developer workstations or CI runners. This can lead to full compromise of the affected environment, impacting confidentiality, integrity, and availability of the system and data. The vulnerability is rated high severity with a CVSS score of 7.8.

A fix is available. Users must upgrade AWS projen to version 0.103.0 and then re-synthesize their projects to regenerate the .projen/tasks.json file with corrected task definitions. Simply upgrading the software without re-synthesizing the project is insufficient because the vulnerable task definition file is committed to the repository. Follow the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-108-aws/ for detailed remediation instructions.