CVE-2025-4318: Remote Code Execution in AWS Amplify codegen-ui

The @aws-amplify/codegen-ui and @aws-amplify/codegen-ui-react packages are core components utilized by AWS Amplify Studio to generate React components, forms, and other frontend views from UI Builder schemas. These UI Builder schemas are represented as JSON files that describe layout properties and interactions.\n\nThis library exposes an attack surface during the compilation phase, where local developer machines, rendering preview servers, or CI/CD pipelines run the codegen execution tools. If an attacker can manipulate these schemas, they can embed malicious JavaScript code directly into property fields and event bindings.\n\nBecause the code generation occurs in a standard Node.js context, any dynamically parsed code is executed with the privileges of the active shell process. This bypasses typical client-side security measures, enabling the attacker to pivot from modifying front-end schemas to executing arbitrary system commands on the compile target.

The root cause of CVE-2025-4318 is improper neutralization of directives in dynamically evaluated code, classified under CWE-95. When processing JSON schemas, the @aws-amplify/codegen-ui compiler converts user-supplied configurations into React AST nodes without validating or sanitizing the input keys and parameters.\n\nInitially, versions up to 2.20.2 parsed the dynamic properties of UI schemas and generated dynamic execution blocks using unsafe eval-like capabilities within Node.js. This allowed an attacker to supply standard library commands (such as those involving child_process and fs) inside property bindings, which the engine executed during compilation.\n\nAlthough the development team attempted to mitigate this in version 2.20.3 by introducing a list of blocked scripting patterns (scriptingPatterns), the sanitation check was incomplete. The initial patch only filtered base properties, while other critical fields, specifically event handler fields like bindingEvent, remained completely unvalidated, leading to bypass vectors that were not solved until version 2.20.4.

Analyzing the patch history reveals the evolution of the fix. In version 2.20.3, developers added a denylist-based sanitation helper to filter out dangerous JavaScript keywords and DOM manipulation syntax from component properties.\n\ntypescript\n// Denylist check in packages/codegen-ui-react/lib/utils/constants.ts\nexport const scriptingPatterns = [\n /eval\\s*\\(/i,\n /Function\\s*\\(/i,\n /setTimeout\\s*\\(/i,\n /new\\s+Function/i,\n /require\\s*\\(/i,\n /__proto__/i,\n /\\$\\{/i\n];\n\n\nHowever, event binding compilation did not use this helper, leaving event workflows vulnerable to injection. In version 2.20.4, the fix was completed by wrapping the bindingEvent compile phase in the sanitation pipeline as shown below:\n\ntypescript\n// Fixed code in packages/codegen-ui-react/lib/workflow/events.ts\nexport function buildBindingEvent(\n componentType: string,\n event: BoundStudioComponentEvent,\n eventName: string,\n): JsxAttribute {\n // Sanitization applied to event.bindingEvent via escapePropertyValue\n const sanitizedBindingEvent = escapePropertyValue(event.bindingEvent);\n const expr = factory.createIdentifier(sanitizedBindingEvent);\n return factory.createJsxAttribute(\n factory.createIdentifier(mapGenericEventToReact(componentType as Primitive, eventName as StudioGenericEvent)),\n factory.createJsxExpression(undefined, expr),\n );\n}\n\n\nBy forcing the event.bindingEvent value through the escapePropertyValue helper, any malicious pattern returning true on the scriptingPatterns regular expression is neutralized, preventing the execution of arbitrary Node.js scripts.

Exploitation of CVE-2025-4318 begins with an attacker gaining lower-privileged authenticated access to AWS Amplify Studio. The attacker then targets a UI component, preparing a malicious component schema that contains system commands mapped to standard parameters like bindingEvent inside buttons or other forms.\n\nmermaid\ngraph LR\n Attacker[\"Attacker (Low Privilege)\"] -->|Uploads Malicious Schema| AmplifyStudio[\"AWS Amplify Studio\"]\n AmplifyStudio -->|Syncs Schema| DevMachine[\"Developer Machine (amplify pull)\"]\n DevMachine -->|Runs codegen-ui Compiler| Execution[\"Node.js execution of arbitrary commands\"]\n\n\nWhen a developer or a automated CI/CD pipeline agent runs amplify pull or standard code-generation tasks, the local compiler fetches the compromised remote JSON schema from the cloud configuration. During AST compilation, the injected JavaScript expressions are evaluated within the host machine's Node.js shell context.\n\nBecause the host environment runs with local user context, the executed command has full access to the machine's file system, environment variables, and network layer. This allows an attacker to exfiltrate active cloud credential tokens, environment configurations, and source code directly to external command-and-control servers.

The impact of this vulnerability is critical, as reflected in its CVSS score of 9.0. It allows authenticated low-privileged users to pivot into remote code execution on the local workstations of any developer working on the project or the host build machines of associated automated pipelines.\n\nSince developers often run shell sessions with persistent AWS CLI profiles, an attacker can harvest credentials stored in environment variables or within standard configuration files. Similarly, CI/CD pipeline targets (e.g., AWS CodeBuild or GitHub Actions runners) possess broad IAM and repository write privileges, creating risks of supply chain poisoning.\n\nThrough this execution pattern, a compromise can spread downstream to other applications and infrastructure. Organizations using unpatched @aws-amplify/codegen-ui dependencies are highly vulnerable to repository tampering and database access exfiltration, because code execution occurs seamlessly during routine code-generation steps.

To address CVE-2025-4318 completely, development and security teams must upgrade all instances of @aws-amplify/codegen-ui and @aws-amplify/codegen-ui-react to version 2.20.4 or higher. Any transitive dependencies should also be refreshed.\n\nProjects using lockfiles should run command sequences to verify that the locked versions are resolved above the vulnerable threshold. In situations where an immediate package upgrade is impossible, teams should restrict permissions in AWS Amplify Studio to block unauthorized users from creating or editing component models.\n\nFurthermore, code-generation pipelines should execute within restricted container sandboxes that block outbound internet access except to authorized endpoints. This severely limits the utility of an exploit by preventing outbound data exfiltration or reverse shells.