8.4
High
CVE-2026-15895 OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow…
Description
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jsii 1.131 | earliest → < 1.131.0 | 1.131.0 |