CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)
Bulletin ID: 2026-173-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 11/06/2026 09:00 AM PST
Description:
Trusted Remote Execution (REX) is an open-source framework for executing sandboxed scripts on managed instances, where a signed Cedar policy is meant to be the immutable security boundary around each script run.
We identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS Systems Manager (SSM) documents (Rex-RO and Rex-RW) for running scripts on managed instances. Due to how the example script handled input parameters, a user with permissions to invoke the SSM document could supply crafted input that would run unintended operating system commands on the managed instance, outside of the REX sandbox. The scriptArgs parameter is affected by the same class of issue.
Impacted versions:
This is not an issue in a shipped REX artifact version. It is an affected example in the set-up documentation. Anyone who created the Rex-RO / Rex-RW SSM documents by following the guide is affected.
Resolution:
We removed this set-up example from the guide. We recommend you delete any SSM documents if you created them, in each account/region where you ran the example:
Workarounds:
None.
References:
Please email aws-security@amazon.com with any security questions or concerns.