Threats affecting pkg:github/aws/res

AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets. It's recommended to upgrade to RES version 2026.06.

CVE-2026-5709 is a high-severity OS command injection vulnerability in AWS Research and Engineering Studio (RES) versions 2024.10 through 2025.12.01. It arises from unsanitized input in the FileBrowser API, allowing a remote authenticated user to execute arbitrary commands on the cluster-manager EC2 instance. AWS has released a fix in RES version 2026.03 and provides a mitigation patch for existing environments. This vulnerability requires authenticated access and does not have known exploits in the wild at this time.

CVE-2026-5708 is a high-severity vulnerability in AWS Research and Engineering Studio (RES) prior to version 2026.03. It involves improper control of user-modifiable attributes during session creation, allowing an authenticated remote user to escalate privileges and assume the virtual desktop host instance profile permissions. This could enable interaction with AWS resources and services beyond intended access. AWS manages the remediation for this cloud service and advises upgrading to version 2026.03 or applying the corresponding mitigation patch. No known exploits in the wild have been reported.

CVE-2026-5707 is an OS command injection vulnerability in AWS Research and Engineering Studio (RES) versions 2025.03 through 2025.12.01. It arises from unsanitized input in the handling of virtual desktop session names, allowing a remote authenticated user to execute arbitrary commands as root on the virtual desktop host. AWS has released a fix in version 2026.03 and recommends upgrading or applying the mitigation patch.

CVE-2025-12815 is a medium severity vulnerability in AWS Research and Engineering Studio (RES) before version 2025.09. It involves an ownership verification flaw on the Virtual Desktop preview page that could allow an authenticated user to view metadata and periodic screenshots of another user's active desktop session. This issue is fixed in version 2025.09.