CVE-2025-4318
CVE-2025-4318 · Input validation issue in AWS Amplify Studio UI component properties
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
CVSS 9.0 · Crítica · EPSS 1,0% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
amplify studio
- Versiones
- ≥ 0.1.0, < 2.20.3: Afectada (semver)
Actualiza a 2.20.3
@aws-amplify/codegen-ui-react npm
- Intervalos de versiones afectados
- SEMVER: < 2.20.3
Actualiza a 2.20.3
Fuentes originales
- https://aws.amazon.com/security/security-bulletins/AWS-2025-010/
- https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3
- https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8
- https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/
- https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6
- https://nvd.nist.gov/vuln/detail/CVE-2025-4318