CVE-2025-4318
CVE-2025-4318 · Input validation issue in AWS Amplify Studio UI component properties
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
CVSS 9.0 · Critical · EPSS 1.0% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
amplify studio
- Versions
- ≥ 0.1.0, < 2.20.3: Affected (semver)
Update to 2.20.3
@aws-amplify/codegen-ui-react npm
- Affected ranges
- SEMVER: < 2.20.3
Update to 2.20.3
Original sources
- https://aws.amazon.com/security/security-bulletins/AWS-2025-010/
- https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3
- https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8
- https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/
- https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6
- https://nvd.nist.gov/vuln/detail/CVE-2025-4318