CVE-2026-89066: OS command injection in the task synthesis component in projen
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions.
To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
projento a version that resolves this vulnerability.Fixed in 0.103.0 - Operational
After upgrading to projen 0.103.0, re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions (since the generated task definition file is committed to the repository).
Event History
Frequently Asked Questions
Which environments are at risk?
Developer workstations and continuous integration runners are at risk when they execute generated projen task definitions containing unneutralized shell metacharacters. Exploitation is context-dependent and requires user interaction.
What input can an attacker use to trigger command execution?
An attacker may use shell metacharacters in project configuration values or repository file names when those values are interpolated into generated task definitions.
What remediation is required?
Upgrade projen to version 0.103.0 and re-synthesize the project to regenerate .projen/tasks.json with corrected task definitions. Upgrading the package alone is insufficient because the generated task definition file is committed to the repository.