Live › vulnerability › GHSA-q6g4-h6vc-vqm8
Go to dashboardprojen is a tool that generates project configuration from code. A crafted entry in the committed .projen/files.json can make it recursively delete files outside the project (CVE-2026-89065), and shell metacharacters in config values or repository file names can run arbitrary commands on a developer workstation or CI runner when tasks are synthesized (CVE-2026-89066).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC. All times on this page are UTC.
Any team that uses projen to generate and maintain project configuration, especially where .projen/files.json or .projen/tasks.json are committed to a repository and projen runs on developer workstations or CI runners. Projects that do not use projen, or that run it only on fully trusted, reviewed repositories, face lower practical exposure.
No product ranges from the sources yet.
npx projen --version or in package.json for projen; versions below 0.101.37 are affected by CVE-2026-89065 and below 0.103.0 by CVE-2026-89066..projen/files.json in version control history for entries that point outside the project directory..projen/tasks.json and project config values (for example LambdaFunctionOptions.entrypoint, JestOptions.extraCliOptions, PytestOptions.testMatch, ReleaseOptions.artifactsDirectory) for shell metacharacters.0.101.37 or later for CVE-2026-89065; re-synthesis is not required.0.103.0 or later for CVE-2026-89066, then re-run projen synthesis and commit the regenerated .projen/tasks.json.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection
Bulletin ID: 2026-108-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/11/2026 09:00 AM PDT
Description:
projen is an open-source tool for defining and synthesizing software project configurations as code. AWS identified two issues in projen affecting the generated file manifest cleanup component and the task synthesis component.
Impacted versions:
Resolution:
We recommend upgrading to the latest version and ensuring any derivative code is patched to incorporate the new fixes.
Workarounds:
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-q6g4-h6vc-vqm8")