CVE-2026-115414

CVE-2026-115414 · OS command injection in the Terraform hook in AWS SAM CLI

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To remediate this issue, users should upgrade to version 1.166.2 or later.

CVSS 8.4 · Élevée · EPSS 0,9% · Correctif disponible

Publication: 2026-10-22T18:34:08.488Z
Mise à jour: 2026-10-23T10:56:19.844Z

Produits et versions concernés

aws-sam-cli
Versions du logiciel
- ≥ 1.63.0, < 1.166.2: Concernée (custom)
Mettez à jour vers 1.166.2

Sources originales

https://github.com/aws/aws-sam-cli/releases/tag/v1.166.2
https://aws.amazon.com/security/security-bulletins/2026-145-aws/
https://github.com/aws/aws-sam-cli/security/advisories/GHSA-44mq-wjrh-vpj6
https://nvd.nist.gov/vuln/detail/CVE-2026-115414

Vérifiez votre serveur →

CVE-2026-115414 · OS command injection in the Terraform hook in AWS SAM CLI

Produits et versions concernés

aws-sam-cli

Sources originales