Skip to content

[GHSA-h738-vh6g-q8gh] OS command injection in the npm package loading component... #8847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Franklyn-R-Silva wants to merge 1 commit into from
Closed

[GHSA-h738-vh6g-q8gh] OS command injection in the npm package loading component... #8847

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 28 additions & 7 deletions advisories/unreviewed/2026/07/GHSA-h738-vh6g-q8gh/GHSA-h738-vh6g-q8gh.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h738-vh6g-q8gh",
"modified": "2026-07-15T21:31:22Z",
"modified": "2026-07-15T21:31:26Z",
"published": "2026-07-15T21:31:22Z",
"aliases": [
"CVE-2026-15895"
],
"summary": "jsii-diff vulnerable to OS command injection via crafted npm: package specifiers",
"details": "OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.\n\n\n\nTo mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},

@Franklyn-R-Silva Franklyn-R-Silva Jul 28, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two notes on the severity block in this PR, both caused by the advisory edit
form rather than intentional changes:

  1. CVSS v4 vector normalization
    The original v4 vector string could not be parsed by the edit form, which
    blocked submission. It was normalized by removing the trailing "Not Defined"
    (:X) threat, environmental, and supplemental placeholders. All eleven base
    metrics are unchanged (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
    and the score remains 8.4 / High.

  2. Unintended removal of the CVSS v3.1 entry
    The form only allows selecting a single CVSS version, so saving the v4 vector
    dropped the existing CVSS_V3 entry:
    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    This removal was not intended. Please let me know if you would like it
    restored and I will push a commit adding it back, or feel free to restore it
    during curation.

The substantive change in this PR is the missing npm ecosystem and package
mapping for jsii-diff, plus the source code location.

{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsii-diff"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.131.0"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
Expand All @@ -27,6 +44,10 @@
"type": "WEB",
"url": "https://aws.amazon.com/security/security-bulletins/2026-057-aws"
},
{
"type": "PACKAGE",
"url": "https://github.com/aws/jsii"
},
{
"type": "WEB",
"url": "https://github.com/aws/jsii/releases/tag/v1.131.0"
Expand Down