Vulnerability-Lookup

GHSA-HF3J-86P7-MFW8

Vulnerability from github – Published: 2026-07-30 20:57 – Updated: 2026-07-30 20:57

Summary

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Details

Summary

The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS CLI) for generating component files in customers' local applications.

An issue exists in the Amplify Studio property binding process of the amplify-codegen-uipackage that could potentially allow an authenticated user to run arbitrary JavaScript code during the component rendering and build process.

Impact

When importing a component schema using the create-component command, Amplify Studio will import and generate the component on the users' behalf. The expression-binding function does not validate the component schema properties before converting them to expressions. As a result, an authenticated user who can create or modify components could run arbitrary JavaScript code during the component rendering and build process.

Impacted versions: <=2.20.2

Patches

This issue has been addressed partially in version 2.20.3 and additional fixes in 2.20.4. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

There are no workarounds. Upgrade to version 2.20.4.

If you have any questions or comments about this advisory, AWS asks that you contact AWS/Amazon Security via the issue-reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Credit

AWS would like to thank ray the bounty hunter for collaborating on this issue through the coordinated issue disclosure process.

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.20.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@aws-amplify/codegen-ui-react"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.20.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-4318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T20:57:24Z",
    "nvd_published_at": "2025-05-05T19:15:57Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe AWS Amplify Studio [amplify-codegen-ui](https://github.com/aws-amplify/amplify-codegen-ui) is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS CLI) for generating component files in customers\u0027 local applications.\n\nAn issue exists in the Amplify Studio property binding process of the `amplify-codegen-ui `package that could potentially allow an authenticated user to run arbitrary JavaScript code during the component rendering and build process.\n\n### Impact\nWhen importing a component schema using the [create-component](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/amplifyuibuilder/create-component.html) command, Amplify Studio will import and generate the component on the users\u0027 behalf. The expression-binding function does not validate the component schema properties before converting them to expressions. As a result, an authenticated user who can create or modify components could run arbitrary JavaScript code during the component rendering and build process. \n\n**Impacted versions: \u003c=2.20.2**\n\n### Patches\nThis issue has been addressed partially in version [2.20.3](https://github.com/aws-amplify/amplify-codegen-ui/pull/1174) and additional fixes in [2.20.4](https://github.com/aws-amplify/amplify-codegen-ui/pull/1196). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n### Workarounds\nThere are no workarounds. Upgrade to version [2.20.4](https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.4).\n\nIf you have any questions or comments about this advisory, AWS asks that you contact AWS/Amazon Security via the [issue-reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n### Credit\nAWS would like to thank `ray the bounty hunter` for collaborating on this issue through the coordinated issue disclosure process.",
  "id": "GHSA-hf3j-86p7-mfw8",
  "modified": "2026-07-30T20:57:24Z",
  "published": "2026-07-30T20:57:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4318"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-010"
    },
    {
      "type": "WEB",
      "url": "https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aws-amplify/amplify-codegen-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AWS Amplify Studio UI Component Properties Has an Input Validation Issue"
}

CVE-2025-4318 (GCVE-0-2025-4318)

Vulnerability from cvelistv5 – Published: 2025-05-05 18:16 – Updated: 2026-07-29 15:18

Title

Input validation issue in AWS Amplify Studio UI component properties

Summary

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

Severity

9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

AMZN

References

5 references

URL	Tags
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/aws-amplify/amplify-codegen-ui…	patch
https://github.com/aws-amplify/amplify-codegen-ui…	vendor-advisory
https://blog.securelayer7.net/cve-2025-4318-aws-a…	exploit
https://github.com/aws-amplify/amplify-codegen-ui…

Impacted products

1 product

Vendor	Product	Version
Amazon	Amplify Studio	Affected: 0.1.0 , < 2.20.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4318",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-18T16:07:11.415601Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-18T16:15:55.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-28T19:27:08.642Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/"
          },
          {
            "url": "https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8"
          },
          {
            "url": "https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/aws-amplify/amplify-codegen-ui",
          "defaultStatus": "unaffected",
          "packageName": "amplify-codegen-ui",
          "product": "Amplify Studio",
          "vendor": "Amazon",
          "versions": [
            {
              "lessThan": "2.20.3",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process. \u003c/p\u003e"
            }
          ],
          "value": "The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592: Stored XSS"
            }
          ]
        },
        {
          "capecId": "CAPEC-251",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-251: Local Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T15:18:10.368Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-010/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Input validation issue in AWS Amplify Studio UI component properties",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2025-4318",
    "datePublished": "2025-05-05T18:16:34.075Z",
    "dateReserved": "2025-05-05T14:03:53.695Z",
    "dateUpdated": "2026-07-29T15:18:10.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-HF3J-86P7-MFW8

Summary

Impact

Patches

Workarounds

Credit

CVE-2025-4318 (GCVE-0-2025-4318)

Tags

Sightings

Nomenclature