Live › vulnerability › GHSA-7p65-6x86-v7f3
Go to dashboardprojen, a tool that generates project configuration files, has two flaws: a crafted entry in .projen/files.json can make it recursively delete files outside the project directory, and shell metacharacters in project configuration values or repository file names can be injected into generated task definitions in .projen/tasks.json. An attacker who can change those files or names can run arbitrary commands on a developer workstation or CI runner.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC. All times on this page are UTC.
Any project that uses projen before 0.101.37 (path traversal) or before 0.103.0 (command injection) is exposed. The command injection needs attacker influence over project configuration values or repository file names, so it matters most for projects that accept outside contributions or run projen on CI runners. Projects not using projen can skip it.
No product ranges from the sources yet.
npx projen --version or grep -A1 '"projen"' package.json and compare to 0.101.37 and 0.103.0.projen/files.json in version control history for entries that point outside the project directory.projen/tasks.json and project configuration values (for example LambdaFunctionOptions.entrypoint, JestOptions.extraCliOptions, PytestOptions.testMatch, ReleaseOptions.artifactsDirectory) for shell metacharacters0.103.0 or later (0.101.37 or later fixes only CVE-2026-89065)npx projen) so .projen/tasks.json is regenerated and committed.projen/files.json and any shell metacharacters from configuration values before running projenThe fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection
Bulletin ID: 2026-108-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 09:00 AM PDT
Description:
projen is an open-source tool for defining and synthesizing software project configurations as code. AWS identified two issues in projen affecting the generated file manifest cleanup component and the task synthesis component.
Impacted versions:
Resolution:
We recommend upgrading to the latest version and ensuring any derivative code is patched to incorporate the new fixes.
Workarounds:
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-7p65-6x86-v7f3")