All vulnerabilities
CVE-2026-115414GHSA-44mq-wjrh-vpj6

aws-sam-cli: OS command injection in the Terraform hook in AWS SAM CLI

AWS aws-sam-cliContainers & cloud
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.88%Chance of exploitation activity in the next 30 days, higher than 58% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.166.2Fixed versionCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address.

To remediate this issue, users should upgrade to version 1.166.2 or later.

Text from CVE List

Affected versions 1

  • aws-sam-cliaffected: 1.63.0 before 1.166.2CVE List

References 3