CVE-2026-107608: Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.
To remediate this issue, users should upgrade to version 2.267.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS aws-cdk-libto a version that resolves this vulnerability.Fixed in 2.267.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of aws-cdk-lib versions before 2.267.0 that use asset bundling output handling may be exposed. The impact depends on the build context because files from the build host could be published as a deployed asset.
What does an attacker need to exploit this vulnerability?
The reported vector is local and requires user interaction, with no privileges required according to the supplied severity vector. Exploitation is context-dependent and involves influencing link resolution before file access during asset bundling output handling.
Is there a workaround if upgrading cannot happen immediately?
No workaround or configuration mitigation is provided in the available information. The stated remediation is to upgrade aws-cdk-lib to version 2.267.0 or later.