OS command injection in jsii-diff in AWS jsii

Bulletin ID: 2026-057-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/15/2026 12:00 PM PDT Last Updated Date: 07/16/2026 10:30 AM PDT Description: jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. We identified CVE-2026-15895 , an issue where specially formatted command line arguments can be used to execute shell commands via this tool. Impacted versions:   Resolution: This issue has been addressed in jsii-diff version 1.131.0 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If you are unable to update, make sure only trusted actors can control the arguments passed to jsii-diff. References: CVE-2026-15895 GHSA-wcx4-wpfv-mc5c Acknowledgement: We would like to thank Junming Wu for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns. "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-057-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-15895: OS command injection in jsii-diff in AWS jsii Bulletin ID: 2026-057-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/15/2026 12:00 PM PDT Last Updated Date: 07/16/2026 10:30 AM PDT Description: jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. We identified CVE-2026-15895 , an issue where specially formatted command line arguments can be used to execute shell commands via this tool. Impacted versions:   Resolution: This issue has been addressed in jsii-diff version 1.131.0 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If you are unable to update, make sure only trusted actors can control the arguments passed to jsii-diff. References: CVE-2026-15895 GHSA-wcx4-wpfv-mc5c Acknowledgement: We would like to thank Junming Wu for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns. {"data":{"items":[{"fields":{"footer":"{ "createAccountButtonLabel": "Create an AWS account", "createAccountButtonURL": "https://signin.aws.amazon.com/signup?request_type=register", "backToTopText": "Back to top", "eoeText": "Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability or other legally protected status. Veterans, military spouses, and people with disabilities are encouraged to apply.", "copyrightText": "© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.", "items": [ { "name": "Learn", "linkURL": "", "items": [ { "heading": "What Is AWS?", "linkURL": "/what-is-aws/?nc1=f_cc" }, { "heading": "What Is Cloud Computing?", "linkURL": "/what-is-cloud-computing/?nc1=f_cc" }, { "heading": "What Is Agentic AI?", "linkURL": "/what-is/agentic-ai

Severity from

no source yet

• aws.amazon.com/security/security-bulletins/rss/2026-057-aws/
• www.cve.org/CVERecord?id=CVE-2026-15895