VulnSocial

CVE-2026-18245Disclosure(amazon / amplify_codegen_ui)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-4318. To remediate this issue, users should upgrade to version 2.20.6

amazon CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • amplify_codegen_ui

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-30); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
amazon
Products
amplify_codegen_ui

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-30: 2Mentions · 2026-07-31: 1PoC Mentioned / Linked · 2026-07-31: 1Technical Details · 2026-07-30: 2Technical Details · 2026-07-31: 107-3007-31
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-302
Disclosure1General1
2026-07-311
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-18245 Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-use… https://www.cve.org/CVERecord?id=CVE-2026-18245

    Post summary

    The text announces CVE‑2026‑18245, noting a remote code execution risk due to improper code generation, but provides no PoC, exploit, or patch information.

    011001.4K
    57.9K followersView on X
  • Israel@f1tym1
    Disclosure

    CVE-2026-18245 in AWS Amplify Codegen UI allows authenticated users to execute arbitrary code across multiple contexts, including browsers and CI/CD pipelines. https://ift.tt/VwBrbj2

    Post summary

    CVE-2026-18245 exposes AWS Amplify Codegen UI to authenticated code execution across browsers and CI/CD pipelines, with a linked reference that likely contains a PoC.

    0000079
    1.0K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-18245 Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-use… https://www.cve.org/CVERecord?id=CVE-2026-18245 ----- Traducción: CVE-2026-18245 Rep… http://infoflow.cloud`

    Post summary

    The tweet announces CVE‑2026‑18245, a potential remote code execution flaw in Amazon Amplify Codegen UI React before version 2.20.6, and links to the CVE record, but offers no PoC, exploit, or patch details.

    0000060
    96 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appamazonamplify_codegen_ui-node.js-

Explore more

Back to dashboardamazon CVEsamplify_codegen_ui vulnerabilities