CVE-2026-85012
Received Received - Intake

Command Injection in AWS CodeCatalyst Blueprint Resynthesis

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: AMZN

Description
Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint resynthesis environment via shell metacharacters in the owner field of a [local] merge strategy entry in a crafted .ownership-file. Version 0.3.156 removes shell interpretation of the owner field, running the command directly rather than through a shell, and rejects values outside an allowlisted command form. This eliminates shell metacharacter command injection. To remediate this issue, users should upgrade to version 0.3.156 or later. No action is required for use of the Amazon CodeCatalyst service. Resynthesis runs in an isolated per-project environment with scoped credentials, and the service applies server-side validation there that rejects [local] merge strategy commands outside a restricted allowlisted form, including for blueprint versions published before 0.3.156.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85012
EUVD
EUVD-2026-70646

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amazon codecatalyst-blueprints From 0.3.156 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper neutralization of special elements used in an OS command (CWE-78) in Amazon Web Services codecatalyst-blueprints before version 0.3.156. It allows a user with commit permissions to execute arbitrary commands in the blueprint resynthesis environment by using shell metacharacters in the owner field of a local merge strategy entry in a crafted .ownership file.

Detection Guidance

This vulnerability involves improper neutralization of special elements in the owner field of a .ownership file in AWS CodeCatalyst blueprints. Detection requires checking for suspicious .ownership files in repositories with blueprint resynthesis enabled. Look for files containing [local] merge strategy entries with shell metacharacters in the owner field. No specific commands are provided in the context.

Impact Analysis

Affected users could have arbitrary commands executed in the isolated blueprint resynthesis environment. This could lead to unauthorized actions, data exfiltration, or system compromise within the project's scope. The impact is limited to users with commit permissions in the project.

Mitigation Strategies

Upgrade to version 0.3.156 or later of the blueprint resynthesis framework to remove shell interpretation of the owner field. No action is required for Amazon CodeCatalyst service users as server-side validation already rejects unsafe commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart