VulnSocial

CVE-2026-119085

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-03: 111-03
Referenced assets1 URL
By indicator
Full discourse1 post
  • 星野ぽぽぽ / キュアクラウド@hoshino_popopo_

    Virtual Engineering Workbench の公開処理に脆弱性対応が必要だよ Virtual Engineering Workbench の公開コンポーネントに、テンプレートインジェクションの脆弱性 CVE-2026-119085 が見つかったよ。 認証済みの第三者が、公開用 Lambda の IAM ロール権限で任意コードを実行できる可能性があるため、c146486 より前のコミットを使っている環境は確認してね。 CVE-2026-119085 - Template injection in the publishing component of Virtual Engineering Workbench https://aws.amazon.com/security/security-bulletins/2026-162-aws/

    00000199
    8.4K followersView on X

Explore more

Back to dashboard