Live › vulnerability › CVE-2026-115414
Go to dashboardThe Terraform hook in AWS SAM CLI builds a Makefile recipe that interpolates a Terraform resource address without neutralizing shell metacharacters. An actor who can influence the Terraform configuration or plan file consumed by a build can run arbitrary commands as the build user on the host running the build.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run on versions from through are exposed, especially where Terraform configuration or plan files come from untrusted sources, shared repositories, or third-party modules. Projects that do not use the Terraform hook, or that run SAM CLI at or later, can skip it.
sam build --hook-name terraform1.63.01.166.11.166.2No product ranges from the sources yet.
sam --version and compare against the affected range >=1.63.0, <=1.166.1.sam build --hook-name terraform in CI or on developer machines.v1.166.2 or later.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT
Description:
AWS SAM CLI is an open-source framework for building serverless applications. We identified CVE-2026-115414, an OS command injection issue in the Terraform hook (sam build --hook-name terraform) in AWS SAM CLI. The Terraform hook generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters, which could allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build.
Impacted versions: >=1.63.0, <=1.166.1
Resolution:
This issue has been addressed in AWS SAM CLI version v1.166.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes..
Workarounds:
Ensure that Terraform configuration files and plan files consumed by sam build --hook-name terraform come only from trusted sources, and audit third-party Terraform modules and shared repositories that supply input to the build. Upgrading to a fixed version is the recommended remediation.
References:
Acknowledgement:
We would like to thank Shubham Raj of Cipher by Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-115414")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.