CVE-2026-115414: OS command injection in the Terraform hook in AWS SAM CLI

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-78

Description

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To remediate this issue, users should upgrade to version 1.166.2 or later.

Affected products

aws-sam-cli: from 1.63.0 before 1.166.2 — fixed in 1.166.2

How to fix

Upgrade to a fixed version: aws-sam-cli 1.166.2. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/2026-145-aws/
https://github.com/aws/aws-sam-cli/releases/tag/v1.166.2
https://github.com/aws/aws-sam-cli/security/advisories/GHSA-44mq-wjrh-vpj6

Get alerted when CVE-2026-115414 or the next vulnerability affects your stack