In plain language
What this advisory means
Amazon discovered a security issue in the CodeCatalyst blueprints framework where a specific field in a project file could be exploited to run harmful commands on the system during project setup if a user had commit access. AWS runs this process in a secure, isolated environment and has validations to stop this exploit when using their service, so users of the service don’t need to take any action. However, for people using the open-source blueprints package directly, upgrading to version 0.3.156 or later eliminates the risk.
Technical explanation
How the issue affects the environment
The vulnerability (CVE-2026-85012) exists in the @amazon-codecatalyst/blueprints.blueprint npm package prior to version 0.3.156. During the blueprint resynthesis process, the framework reads a .ownership-file to determine modifiable files. In versions before 0.3.156, the 'owner' field of a '[local]' merge strategy entry was passed through a shell command without validation or sanitization. Malicious shell metacharacters placed in this field by a user with commit permission to the repository could lead to OS command injection, executing arbitrary commands with the environment's privileges. The 0.3.156 release removes shell interpretation by running commands directly and enforces an allowlist to reject unsafe command forms, preventing command injection.
Operational impact
Why teams should care
If exploited, an attacker with commit access could execute arbitrary commands during blueprint resynthesis, potentially compromising the build environment. For users employing AWS CodeCatalyst's managed service, the impact is negligible due to isolated environments and server-side validation blocking unsafe commands. However, direct users of the vulnerable npm package could face risks to system integrity if they do not upgrade.
Immediate action
Upgrade to @amazon-codecatalyst/blueprints.blueprint version 0.3.156 or later, which removes shell interpretation of the owner field and rejects disallowed command forms to eliminate command injection risk. Also, ensure any forked or derivative code is patched accordingly.
Affected and fixed releases
Temporary risk reduction
No effective workaround exists other than upgrading for direct consumers of the npm package. For users of the Amazon CodeCatalyst service, no action is required as server-side protections and isolated environments mitigate the risk.
Evidence and validation checklist
- AWS Security Bulletin 2026-095-AWS detailing CVE-2026-85012
- Description of unsafe shell invocation of owner field before version 0.3.156
- Release notes for version 0.3.156 removing shell interpretation and adding validation
- AWS statement that no action is needed for CodeCatalyst service users due to isolation and validation
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.