Live › vulnerability › GHSA-h6j4-qpp7-q28p
Go to dashboardWhen aws-cdk-lib bundles an asset with a Docker file, a malicious Docker build can insert symlinks into the bundling output that were never declared as inputs. Those links can point at files outside the bundle, so the synthesized output may carry data the project did not intend to deploy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:28 UTC. All times on this page are UTC.
Projects that use aws-cdk-lib before 2.267.0 and bundle assets with a Dockerfile are exposed, because the bundling container can add symlinks to the output. Teams that only use non-Docker asset bundling or that never build assets in containers can skip it, as can those whose bundling images are fully trusted.
No product ranges from the sources yet.
npm ls aws-cdk-lib (or check the lockfile) to find the installed aws-cdk-lib version.Code.fromAsset or DockerImage bundling and confirm they come from trusted sources.aws-cdk-lib to 2.267.0 or later.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-107608: Improper link resolution in asset bundling output handling in aws-cdk-lib
Bulletin ID: 2026-131-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 12:30 PM PDT
Description:
AWS CDK is an open source framework that allows customers to build cloud infrastructure using their favorite programming language (Python, Typescript, C#, Go). That infrastructure is then able to be deployed with AWS CDK command line commands to AWS CloudFormation. We identified CVE-2026-107608, which is an issue where Docker files could be configured to insert symlinked files into the output of the AWS CDK asset bundling process when it was invoked with a Docker file. When bundling an asset using AWS CDK with a docker file, prior to 2.267.0, it was possible for a docker file to insert a symlinked file or directory into the output of asset bundling without the symlink having been provided as input to the bundling process.
Impacted versions: All aws-cdk-lib versions before 2.267.0
Resolution:
This issue has been addressed in aws-cdk-lib version 2.267.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
If you cannot immediately upgrade, you can reduce the possibility of streaming unexpected information by auditing all Docker bundling containers and their dependencies to confirm that no untrusted code executes inside the configured bundling environment.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-h6j4-qpp7-q28p")