CVE-2026-85012

CVE-2026-85012 is an OS command injection flaw (CWE-78) in the blueprint resynthesis framework of Amazon Web Services' codecatalyst-blueprints package before version 0.3.156. A user with permission to commit to a repository in the project can plant a crafted .ownership-file whose [local] merge strategy entry carries shell metacharacters in the owner field; when blueprint resynthesis runs, that field is passed through a shell and the injected commands execute. The attacker thereby gains arbitrary command execution in the resynthesis environment, which runs isolated per project with scoped credentials, limiting the blast radius to that environment. Only users who run the resynthesis framework on affected versions are exposed; the managed Amazon CodeCatalyst service applies equivalent server-side validation (including for blueprint versions published before 0.3.156), so service users require no action. No public proof-of-concept or in-the-wild exploitation is known, EPSS estimates roughly a 1.1% probability of exploitation within 30 days (62nd percentile), and the flaw is not in CISA's KEV catalog; the CVSS 4.0 score of 8.5 (high) reflects that the attack requires commit-level privileges and that resynthesis must actually run.

What to do: Upgrade codecatalyst-blueprints to 0.3.156 or later, which stops shell interpretation of the owner field and rejects values outside an allowlisted command form. Until upgraded, restrict commit access to trusted collaborators and inspect .ownership-file changes, especially owner fields of [local] merge strategy entries, for shell metacharacters before running resynthesis. Users of the managed Amazon CodeCatalyst service need no action, as the service already validates these commands server-side in the isolated resynthesis environment.