CVE-2026-115414: OS command injection in the Terraform hook in AWS SAM CLI
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.
To remediate this issue, users should upgrade to version 1.166.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS SAM CLIto a version that resolves this vulnerability.Fixed in 1.166.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Build environments using AWS SAM CLI before 1.166.2 are exposed when their Terraform hook consumes a Terraform configuration or plan file that an actor can influence. The injected commands execute as the user running the build on that host.
What does an attacker need to exploit this issue?
The attacker needs the ability to influence the Terraform configuration or plan file used by a build and must craft a Terraform resource address. Exploitation also requires a user to run the affected build workflow.
Are default installations affected?
The issue is specific to use of the Terraform hook. The provided information does not establish exposure for installations that do not consume Terraform configuration or plan files through that hook.
What is the remediation?
Upgrade AWS SAM CLI to version 1.166.2 or later.