{"id":"CVE-2026-119085","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-119085","generatedAt":"2026-11-04T11:49:45.674Z","title":"Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing…","description":"Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.\n\n\n\nTo remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.","published":"2026-11-02T18:18:44.000Z","lastModified":"2026-11-03T17:18:02.000Z","status":"Awaiting Analysis","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","cvss":{"version":"4.0","score":9.4,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-1336"],"affected":[],"epss":{"score":0.00481,"percentile":0.41527,"date":"2026-11-03","history":[{"date":"2026-11-03","score":0.00481,"percentile":0.41527}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-11-02T18:18:44.000Z","detail":{"score":"9.4","severity":"CRITICAL","publishedAt":"2026-11-02T18:18:44.283Z"},"summary":"New CVE, critical severity (CVSS 9.4)."}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-162-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/awslabs/virtual-engineering-workbench/security/advisories/GHSA-mf9w-9v72-cqm9","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-119085","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}