CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK

CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK

Bulletin ID: 2026-095-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/03/2026 10:00 AM PDT

Amazon CodeCatalyst blueprints are reusable project templates that generate a software project. The @amazon-codecatalyst/blueprints.blueprint npm package is the open source framework that blueprint authors build on, published from github.com/aws/codecatalyst-blueprints.

We identified CVE-2026-85012 in the blueprint resynthesis framework. During resynthesis, the framework reads the .ownership-file from the existing project to determine which files a blueprint may modify. In versions before 0.3.156, the owner field of a [local] merge strategy entry in the .ownership-file was passed to an operating system command through a shell without validation. A user with permission to commit to a repository in the project could place shell metacharacters in that field and execute arbitrary commands in the environment performing resynthesis, with the privileges and credentials available to that environment.

No action is required for use of the Amazon CodeCatalyst service. Resynthesis runs in an isolated per-project environment with scoped credentials, and the service applies server-side validation there that rejects [local] merge strategy commands outside a restricted allowlisted form, including for blueprint versions published before 0.3.156.

This issue has been addressed in @amazon-codecatalyst/blueprints.blueprint version 0.3.156. Version 0.3.156 removes shell interpretation of the owner field, running the command directly rather than through a shell, and rejects values outside an allowlisted command form. This eliminates shell metacharacter command injection. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.