CVE-2026-13760: OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strin

highCVSS 7.3CVE-2026-13760

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. To remediate this issue, users should upgrade to v2.260.0.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.3
Published: 2026-07-01
Last updated: 2026-07-01
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13760

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-137600.61% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-13760	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownCVE-2026-13760 - OS Command Injection in NodejsFunction Docker Bundling in aws-cdk-libaws

Recent advisories for OS command injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2025-30007: HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows…nvd · 2026-07-10
criticalCVE-2026-56688: Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Spe…nvd · 2026-07-10
unknownCVE-2026-41880: R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) mo…nvd · 2026-07-10
unknownCVE-2026-41876: R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document c…nvd · 2026-07-10
highGHSA-w9mx-xmg4-gc4r: laravel-backup-restore has an OS Command Injection during database restoreghsa · 2026-07-09
unknownCVE-2026-0286: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® softwar…nvd · 2026-07-09