A command injection vulnerability exists in the npm package loading component of AWS jsii-diff before version 1.131.0. This flaw allows context-dependent attackers to execute arbitrary OS commands by supplying crafted package specifiers to the npm: source argument. The vulnerability is addressed in jsii-diff version 1.131.0 and later.