Bulletin ID: 2026-095-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 09/03/2026 10:00 AM PDT

Description:

Amazon CodeCatalyst blueprints are reusable project templates that generate a software project. The @amazon-codecatalyst/blueprints.blueprint npm package is the open source framework that blueprint authors build on, published from github.com/aws/codecatalyst-blueprints.

We identified CVE-2026-85012 in the blueprint resynthesis framework. During resynthesis, the framework reads the .ownership-file from the existing project to determine which files a blueprint may modify. In versions before 0.3.156, the owner field of a [local] merge strategy entry in the .ownership-file was passed to an operating system command through a shell without validation. A user with permission to commit to a repository in the project could place shell metacharacters in that field and execute arbitrary commands in the environment performing resynthesis, with the privileges and credentials available to that environment.

No action is required for use of the Amazon CodeCatalyst service. Resynthesis runs in an isolated per-project environment with scoped credentials, and the service applies server-side validation there that rejects [local] merge strategy commands outside a restricted allowlisted form, including for blueprint versions published before 0.3.156.

Impacted versions: <= 0.3.155

Resolution:

This issue has been addressed in @amazon-codecatalyst/blueprints.blueprint version 0.3.156. Version 0.3.156 removes shell interpretation of the owner field, running the command directly rather than through a shell, and rejects values outside an allowlisted command form. This eliminates shell metacharacter command injection. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

For direct consumers of the @amazon-codecatalyst/blueprints.blueprint npm package, upgrading to version 0.3.156 or later is the only mitigation: the .ownership-file is a normal part of a project and the affected merge strategy activates without configuration. No action is required for use of the Amazon CodeCatalyst service.

References:

• CVE-2026-85012
• GHSA-c7rj-fr2j-64w7
  

Acknowledgement:

We would like to thank Vaibhav Kubade for collaborating on this issue through the coordinated vulnerability disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.