CVE-2026-85012 - OS command injection in the Amazon CodeCatalyst blueprints SDK

In plain language

What this advisory means

Amazon CodeCatalyst blueprints are templates used to create software projects. A security problem was found in the open-source framework they use called @amazon-codecatalyst/blueprints.blueprint. In versions before 0.3.156, the software would run system commands containing unvalidated input, allowing someone who can commit code to run harmful commands in the environment that rebuilds projects. However, if you use the Amazon CodeCatalyst service directly, no action is needed because it runs safely with checks. Users should update to version 0.3.156 or later if they use the npm package.

Technical explanation

How the issue affects the environment

CVE-2026-85012 is an OS command injection vulnerability in the @amazon-codecatalyst/blueprints.blueprint npm package before version 0.3.156. The blueprint resynthesis framework reads the .ownership-file to decide which files a blueprint can modify. The 'owner' field of a '[local]' merge strategy entry was passed unsanitized to an OS shell command during resynthesis. An attacker with commit permissions could inject shell metacharacters, executing arbitrary commands with the resynthesis environment's privileges. Version 0.3.156 resolves this by executing the command directly without shell interpretation and restricting inputs to an allowlist, preventing command injection. The Amazon CodeCatalyst service itself runs resynthesis in isolated environments with scoped credentials and server-side validation that forbids unsafe commands, including for older blueprint versions.

Operational impact

Why teams should care

If exploited, an attacker who can commit to a repository could execute arbitrary commands within the environment performing blueprint resynthesis. This could lead to unauthorized actions or compromise of that environment's privileges and credentials. However, users relying on the Amazon CodeCatalyst service are protected by isolation and strict validation and do not need to take action. Direct consumers of the vulnerable npm package must upgrade to avoid risk.

Affected and fixed releases

Temporary risk reduction

No practical workaround other than upgrading the npm package to version 0.3.156 or later. Users of the Amazon CodeCatalyst service do not require any action as server-side validations mitigate the issue.

Evidence and validation checklist

• AWS Security Bulletin 2026-095-AWS detailing CVE-2026-85012
• Description of the vulnerable behavior in versions before 0.3.156
• Statement that the Amazon CodeCatalyst service runs resynthesis in isolated environments with validation
• Fix implementation described in version 0.3.156 removing shell interpretation and applying allowlisting
• Recommendation to upgrade to version 0.3.156 or later