There is a high-severity attack on Amazon CodeCatalyst blueprints that exploits an open-source framework for building them. This vulnerability has been reported by Amazon Web Services. This flaw affects the @amazon-codecatalyst/blueprints.blueprint npm package and can lead to the execution of arbitrary commands in environments operating blueprint resynthesis.  The Amazon CodeCatalyst blueprints serve as template documents for creating software development projects that can be reused. npm package that is affected provides the framework that blueprint authors use to construct these templates and is part of the open-source project AWS CodeCatalyst Blueprints.  During blueprint resynthesis, a vulnerability occurs in the process of determining which files an existing project may modify based on its .ownership-file, which is used to determine whether blueprints can modify them. Versions 0.3.155 and earlier handled the owner field of an entry containing a [local] merge strategy without adequate validation, which left it vulnerable to shell command interpretation.  A repository user with access to commit permissions could potentially use shell metacharacters to alter the affected field. In the context of resynthesis, those characters could be interpreted as commands by the operating system, allowing arbitrary commands to be executed in the resynthesis environment. The executed commands could consequently expose all privileges or credentials available in that environment.  Amazon has rated CVE-2026-85012 as 8.5 on the CVSS 4.0 scale, indicating that it is a high-severity vulnerability. Under CWE-78, which describes improper neutralization of special elements in operating system commands, this vulnerability has been classified as high severity. Amazon CodeCatalyst service deployments that utilize vulnerable versions of the blueprint framework are affected by this issue as opposed to the CodeCatalyst service itself.  As stated by Amazon, CodeCatalyst's resynthesis process operates in a separate environment with unique credentials for each project. Additionally, the service performs server-side validation to block merge strategy commands unless they conform to a restricted allowlist, including older blueprint versions.  AWS Releases Fix for CVE-2026-85012 It has been reported that Amazon has corrected this vulnerability in version 0.3.156 of @amazon-codecatalyst/blueprints.blueprint, which reverts to shell-based command interpretation and executes the relevant command directly in place of shell-based command interpretation. In addition, the patched release restricts accepted values to an allowlisted command format, closing the injection path identified in CVE-2026-85012.  Shell metacharacters are prevented from being interpreted during blueprint resynthesis as additional commands, closing the injection path identified in CVE-2026-85012. There are versions of the package 0.3.155 and earlier that are affected, so Amazon recommends upgrading to version 0.3.156, with forked and derivative implementations also requiring the appropriate security updates. There is no need for Amazon CodeCatalyst customers to respond to this vulnerability on the service-side.  Resynthesis jobs within the service are conducted in isolated environments assigned to specific projects, using scoped credentials. Server-side checks are also applied by AWS to reject [local] merge strategy commands that do not conform to the approved format. In addition, these protections apply when blueprints are published using versions of the framework prior to version 0.3.156.  The primary remediation concern is those projects or development environments that directly utilize the affected open-source framework following the implementation of the package-level fix. This updates the dependency, therefore removing the vulnerable shell execution behavior, and resolving the underlying issue of command injection described in CWE-78. By removing shell interpretation and enforcing an allowlisted command format, version 0.3.156 resolves the underlying command injection issue. Users who are currently using version 0.3.156 should take the necessary steps to update their SDK.

Groups Conversations All groups and messages Sign in     CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK 0 views Eyal Estrin unread, 1:01 PM (1 hour ago)    to https://aws.amazon.com/security/security-bulletins/2026-095-aws/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint resynthesis environment via shell metacharacters in …

著者：佐藤 将(著)　個人出版　2026/1/2(金)配信

After careful consideration, we’re announcing availability changes for a select group of AWS services and features. These changes fall into three lifecycle categories: Services and Capabilities moving to Maintenance Services moving to maintenance will no longer be accessible to new customers starting Nov 7, 2025. Current customers can continue using the service or feature while exploring alternative solutions. Amazon Cloud Directory Amazon CodeCatalyst Amazon CodeGuru Reviewer Amazon Fraud Detector Amazon Glacier Amazon S3 Object Lambda Amazon Workspaces Web Access Client for PCoIP (STXHD) AWS Application Discovery Service AWS HealthOmics - Variant and Annotation Store AWS IoT SiteWise Edge Data Processing Pack AWS IoT SiteWise Monitor AWS Mainframe Modernization Service AWS Migration Hub AWS Snowball Edge Compute Optimized AWS Snowball Edge Storage Optimized AWS Systems Manager - Change Manager AWS Systems Manager - Incident Manager AWS Thinkbox Deadline 10 .NET Modernization Tools Services Entering Sunset The following services are entering sunset, and we are announcing the date upon which we will end operations and support of the service. Customers using these services should click on the links below to understand the sunset timeline (typically 12 months), and begin planning migration to alternatives as recommended in the updated service web pages and documentation. Amazon FinSpace Amazon Lookout for Equipment AWS IoT Greengrass v1 AWS Proton Services Reaching End of Support The following services have reached end of support and are no longer available as of October 7, 2025. AWS Mainframe Modernization App Testing For customers affected by these changes, we've prepared comprehensive migration guides and our support teams are ready to assist with your transition. Visit AWS Product Lifecycle Page to learn more. or contact AWS Support.

After careful consideration, we’re announcing availability changes for a select group of AWS services and features. These changes fall into three lifecycle categories: Services and Capabilities moving to Maintenance Services moving to maintenance will no longer be accessible to new customers starting Nov 7, 2025. Current customers can continue using the service or feature while exploring alternative solutions. * Amazon Cloud Directory * Amazon CodeCatalyst * Amazon CodeGuru Reviewer * Amazon Fraud Detector * Amazon Glacier * Amazon S3 Object Lambda * Amazon Workspaces Web Access Client for PCoIP (STXHD) * AWS Application Discovery Service * AWS HealthOmics - Variant and Annotation Store * AWS IoT SiteWise Edge Data Processing Pack * AWS IoT SiteWise Monitor * AWS Mainframe Modernization Service * AWS Migration Hub * AWS Snowball Edge Compute Optimized * AWS Snowball Edge Storage Optimized * AWS Systems Manager - Change Manager * AWS Systems Manager - Incident Manager * AWS Thinkbox Deadline 10 * .NET Modernization Tools Services Entering Sunset The following services are entering sunset, and we are announcing the date upon which we will end operations and support of the service. Customers using these services should click on the links below to understand the sunset timeline (typically 12 months), and begin planning migration to alternatives as recommended in the updated service web pages and documentation. * Amazon FinSpace * Amazon Lookout for Equipment * AWS IoT Greengrass v1 * AWS Proton Services Reaching End of Support The following services have reached end of support and are no longer available as of October 7, 2025. * AWS Mainframe Modernization App Testing For customers affected by these changes, we've prepared comprehensive migration guides and our support teams are ready to assist with your transition. Visit AWS Product Lifecycle Page to learn more. or contact AWS Support.

Source: https://olcortesb.hashnode.dev/probando-aws-codecatalyst-desde-el-aws-builder-id En este...

Comparing two leading DevOps platforms for source control, CI/CD, and cloud-native development

Beginner’s guide to setting up a dbt dev environment using AWS CodeCatalyst Free Tier, Redshift as target, and VS Code as IDE—based on ryanback-AWS repost article.

こんにちは。 アプリケーションサービス部、DevOps担当の兼安です。 今回はAmazon CodeCatalystで、GitHub Actionsのワークフローを動かす際、ランタイム環境に注意が必要なことをお話しします。 本記事のターゲット Amazon CodeCatalystとは GitHub Actionsで書いたワークフローをAmazon CodeCatalystで実行する方法 Code...

We are building FakeTube - a YouTube clone software engineering project using cloud-native and web...

Amazon CodeCatalyst と AWS CodeDeploy を使い、Web サイト（Laravel を想定）を EC2 にデプロイする手順のメモ。

“ I have checked the documents of AWS to resolve the issue of app creation in generative ai using aws...