CVE-2026-18245

Awaiting Analysis Awaiting Analysis - Queue

Code Execution in AWS Amplify Codegen UI React

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: AMZN

Description

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-18245

EUVD

EUVD-2026-51268

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	aws-amplify_codegen-ui-react	2.20.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper control of code generation in Amazon @aws-amplify/codegen-ui-react before version 2.20.6. A remote authenticated attacker could exploit this to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts by using crafted Studio component or theme schema values. The issue stems from insufficient input validation, which was previously addressed in CVE-2025-4318 but remains inadequate.

Detection Guidance

This vulnerability is specific to the Amazon @aws-amplify/codegen-ui-react library. Detection involves checking the installed version of the library in your project or environment. Use commands like 'npm list @aws-amplify/codegen-ui-react' or 'yarn list @aws-amplify/codegen-ui-react' to verify the version. If the version is below 2.20.6, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to run malicious code on your systems if you are using a vulnerable version of @aws-amplify/codegen-ui-react. This includes end-user browsers, developer machines, CI/CD pipelines, and server-side rendering environments. The impact ranges from data breaches to system compromise, depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR, HIPAA, or other regulations, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade the @aws-amplify/codegen-ui-react library to version 2.20.6 or later immediately. For npm projects, run 'npm update @aws-amplify/codegen-ui-react' or 'npm install @aws-amplify/codegen-ui-react@latest'. For yarn projects, use 'yarn upgrade @aws-amplify/codegen-ui-react' or 'yarn add @aws-amplify/codegen-ui-react@latest'.

Hi! I’m here to help you understand CVE-2026-18245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70