In plain language
What this advisory means
Projen is a tool that helps developers set up and manage software projects using code. Two serious security flaws were found in Projen that could let attackers delete files outside the project or run harmful commands on a developer's computer or automated testing systems. Updating Projen to fixed versions is necessary to prevent these risks.
Technical explanation
How the issue affects the environment
Projen versions before 0.101.37 contain a relative path traversal vulnerability in the generated file manifest cleanup component. This flaw allows attackers to craft entries in the .projen/files.json manifest to recursively delete files and directories outside the intended project directory during project synthesis. Additionally, versions before 0.103.0 have improper neutralization of special shell metacharacters in the task synthesis component. Maliciously crafted project configuration values or repository filenames interpolated into .projen/tasks.json task definitions can enable arbitrary OS command execution on developer or CI environments. The first issue is fixed by an improved containment check applied automatically upon runtime after upgrade. The second requires upgrading Projen to 0.103.0 or later and re-synthesizing projects to regenerate safe task definition files.
Operational impact
Why teams should care
Exploitation can lead to unauthorized deletion of files outside the project scope, causing data loss and disruption. Furthermore, attackers may execute arbitrary commands on developer workstations or CI runners, risking code compromise, data theft, or broader system infiltration. These vulnerabilities can undermine software integrity and developer productivity, impacting business operations reliant on secure and stable software builds.
Immediate action
For CVE-2026-89065, upgrade Projen to version 0.101.37 or later; no project re-synthesis is needed as the fix applies at runtime. For CVE-2026-89066, upgrade Projen to version 0.103.0 or later and re-synthesize your project to regenerate the .projen/tasks.json file with safe task definitions because the file is version-controlled and must be updated.
Affected and fixed releases
Temporary risk reduction
Before upgrading, for CVE-2026-89065, review the version control history of .projen/files.json and remove any entries that allow files outside the project directory to be deleted. For CVE-2026-89066, audit and sanitize project configuration values and repository file names to remove or properly escape shell metacharacters before running Projen.
Evidence and validation checklist
- AWS official security bulletin published 09/11/2026
- Details on vulnerabilities CVE-2026-89065 and CVE-2026-89066 from AWS Security Bulletins
- Fixed versions identified as 0.101.37 (CVE-2026-89065) and 0.103.0 (CVE-2026-89066)
- Official remediation instructions including upgrade and re-synthesis steps
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.