CVE-2026-115414 — OS command injection in the Terraform hook in AWS SAM CLI
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to e…
Published: 2026-10-22 · CVSS: 8.4 · CVSS 4.0
OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To remediate this issue, users should upgrade to version 1.166.2 or later.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7