CVE-2026-89066

Projen before 0.103.0 improperly neutralizes shell metacharacters (CWE-78/CWE-88) in project configuration values and repository file names that are interpolated into generated task definitions by its task synthesis component. An attacker who can influence a project's configuration values or repository file names can inject OS commands that execute when projen-generated tasks are run, gaining arbitrary command execution on the developer workstation or continuous integration runner with the privileges of the user running the task. Because the generated task file (.projen/tasks.json) is typically committed to the repository, a poisoned task definition can persist and execute repeatedly across developers and CI pipelines. Anyone using projen to synthesize or run tasks in affected versions is exposed, with impact limited to the local machine and its credentials/network reachability (CVSS 4.0 score 8.4, local attack vector with user interaction). No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

What to do: Upgrade projen to version 0.103.0 or later, then re-run project synthesis so that the committed .projen/tasks.json is regenerated with corrected task definitions and commit the regenerated file; upgrading alone is not sufficient. Audit repositories for .projen/tasks.json files generated by older versions, review project configuration values and repository file names for shell metacharacters, and avoid running projen tasks from untrusted repositories until updated.