Advisoriesby IbisTemplate injection in the publishing component of Virtual Engineering Workbench
Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST Description: Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development environments, and developers provision them on demand through a web portal. We identified CVE-2026-119085, where improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. Impacted versions: All commits before c146486 (PR #31, merged 2026-05-04) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetImproper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yetStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yetImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in...CVE-2026-119301no fix yetLinux kernel IPv4 TCP use-after-free IssueCVE-2026-98432no fix yetInsertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yet