CVE-2026-107608 — Improper link resolution in asset bundling output handling in aws-cdk-lib
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the…
Published: 2026-10-08 · CVSS: 6.8 · CVSS 4.0
Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or later.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7