{"vulnerability": "cve-2026-1589", "sightings": [{"uuid": "c940bb63-735c-476d-8fa6-593a44b83f26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1589", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mdlejdbdoy2m", "content": "", "creation_timestamp": "2026-01-29T17:59:35.971576Z"}, {"uuid": "811945ab-08d0-4230-9904-5062645829f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15895", "type": "seen", "source": "https://gist.github.com/alon710/990635ffdd01b8358cf96c18cad137b7", "content": "# CVE-2026-15895: CVE-2026-15895: OS Command Injection in AWS jsii-diff CLI\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-15895\n\n## Summary\nAn OS command injection vulnerability exists in the npm package loading component of the jsii-diff CLI tool within the AWS jsii framework. Prior to version 1.131.0, when parsing package specifiers prefixed with `npm:`, the tool concatenated user-controlled inputs directly into a shell execution string via child_process.exec. This allows attackers to execute arbitrary shell commands under the context of the running Node.js process.\n\n## TL;DR\nUnsanitized input interpolation in jsii-diff's NPM package downloader allows local or pipeline-integrated attackers to execute arbitrary shell commands via crafted package names prefixed with npm:.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A)\n- **CVSS Score**: 8.4\n- **EPSS Score**: 0.0063\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- AWS jsii-diff (< 1.131.0)\n- **jsii-diff**: < 1.131.0 (Fixed in: `1.131.0`)\n\n## Mitigation\n\n- Upgrade jsii-diff to version 1.131.0 or later.\n- Validate all package-name parameters against a strict alphanumeric allowlist prior to execution.\n- Incorporate --ignore-scripts in npm configurations to prevent remote package lifecycle execution.\n\n**Remediation Steps:**\n1. Identify any global or local installations of jsii-diff using `npm list -g jsii-diff` or inspecting package.json.\n2. Update global instances via `npm install -g jsii-diff@latest`.\n3. Update project dependencies to ensure `jsii-diff` version >= 1.131.0 is used.\n4. Verify the installation by running `jsii-diff --version`.\n\n## References\n\n- [NVD - CVE-2026-15895](https://nvd.nist.gov/vuln/detail/CVE-2026-15895)\n- [CVE Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-15895)\n- [AWS Security Bulletin](https://aws.amazon.com/security/security-bulletins/2026-057-aws/)\n- [GitHub Release Notes](https://github.com/aws/jsii/releases/tag/v1.131.0)\n- [Remediation Patch Commit](https://github.com/aws/jsii/commit/9f42f274b23e80dd38dce51d0e8847149fcf2528)\n- [AWS jsii-diff Release Commit](https://github.com/aws/jsii/commit/c0a3f35b59af17d8fe4a92292e099fbb08b8ac3c)\n- [GitHub Advisory Database](https://github.com/advisories/GHSA-wcx4-wpfv-mc5c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-15895) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T07:36:05.558981Z"}, {"uuid": "7d36dcbc-e24c-4db4-a459-cfced782c6af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15895", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqplnl5ild2l", "content": "CVE-2026-15895 - OS command injection in jsii-diff in AWS jsii\nCVE ID : CVE-2026-15895\n \n Published : July 15, 2026, 7:16 p.m. | 17\u00a0minutes ago\n \n Description : OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-depend...", "creation_timestamp": "2026-07-15T20:45:24.523029Z"}, {"uuid": "cc0acc35-caa7-4953-83d0-9828fda83f45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvoejuek27", "content": "\ud83d\udd17 CVE : CVE-2026-15899, CVE-2026-15900, CVE-2026-15901, CVE-2026-15902, CVE-2026-15903, CVE-2026-15904, CVE-2026-15905", "creation_timestamp": "2026-07-17T13:55:27.951415Z"}, {"uuid": "57642c45-6128-4f6b-ad3e-02f6358fa7ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116944256682998893", "content": "It is possible to see elevated activities targeting Google Chrome (CVE-2026-15899) https://vuldb.com/vuln/380087/cti", "creation_timestamp": "2026-07-19T02:22:25.478570Z"}, {"uuid": "db4fe62b-d63f-4ec6-bceb-bc0db461d625", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260720", "content": "", "creation_timestamp": "2026-07-20T04:45:40.325667Z"}, {"uuid": "c127066a-5397-4127-bc49-8225b11f3543", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1974", "content": "", "creation_timestamp": "2026-07-20T08:45:12.761884Z"}, {"uuid": "5d70af8a-d622-4408-aed9-860b9de6fa82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4q243qmt2a", "content": "CVE-2026-15899 - Google Chrome CameraCapture Use-After-Free\nCVE ID : CVE-2026-15899\n \n Published : July 20, 2026, 11:16 p.m. | 2\u00a0hours, 28\u00a0minutes ago\n \n Description : Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to ...", "creation_timestamp": "2026-07-21T02:08:36.604965Z"}, {"uuid": "abeef461-fbe8-4835-917f-58b6277f633e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-15899", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116955730635941060", "content": "CVE-2026-15899 (CRITICAL): Use-after-free in Chrome\u2019s CameraCapture on Mac (<150.0.7871.128) enables remote sandbox escape. Update now to 150.0.7871.128. https://radar.offseq.com/threat/cve-2026-15899-use-after-free-in-google-chrome-4986d6558d1d6769 #OffSeq #CVE202615899 #Chrome #infosec", "creation_timestamp": "2026-07-21T03:00:25.973254Z"}, {"uuid": "f21c9cf7-7419-4c05-81cb-24eba558f97f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-15899", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mr4swr5vyu2r", "content": "CRITICAL: CVE-2026-15899 in Chrome CameraCapture on Mac lets attackers escape the browser sandbox via crafted HTML. Update to 150.0.7871.128 ASAP. https://radar.offseq.com/threat/cve-2026-15899-use-after-free-in-google-chrome-4986d6558d1d6769 #OffSeq #Chrome #PatchNow", "creation_timestamp": "2026-07-21T03:00:26.693503Z"}, {"uuid": "27abcede-8ad5-48c0-82bc-386f173c0b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15899", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mraq3l5zzo2e", "content": "CVE-2026-15899 - chrome\nA security issue in Google Chrome on Mac allows a hacker to access sensitive data. This can happen when a user visits a malicious website. To stay safe, update your Google Chrome to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chrome #google #CVE #infosec", "creation_timestamp": "2026-07-22T16:20:05.079084Z"}]}