Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions.
To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://aws.amazon.com/security/security-bulletins/2026-108-aws/
ff89ba41-3aa1-4d27-914a-91399e9639e5
https://github.com/projen/projen/releases/tag/v0.103.0
ff89ba41-3aa1-4d27-914a-91399e9639e5
https://github.com/projen/projen/security/advisories/GHSA-q6g4-h6vc-vqm8
ff89ba41-3aa1-4d27-914a-91399e9639e5