Attributed metadata history
Up to 100 retained publisher events per page for 9b9e9183b9ce1c0a013bf263faba2b52b82c3f9a5783131343938bcd054d926a. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:03 UTC
Bulletin ID: 2026-131-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/08/2026 12:30 PM PDT Description: AWS CDK is an open source framework that allows customers to build cloud infrastructure using their favorite programming language (Python, Typescript, C#, Go). That infrastructure is then able to be deployed with AWS CDK command line commands to AWS CloudFormation. We identified CVE-2026-107608, which is an issue where Docker files could be configured to insert symlinked files into the output of the AWS CDK asset bundling process when it was invoked with a Docker file. When bundling an asset using AWS CDK with a docker file, prior to 2.267.0, it was possible for a docker file to insert a symlinked file or directory into the output of asset bundling without the symlink having been provided as input to the bundling process. Impacted versions: All aws-cdk-lib versions before 2.267.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Fingerprint: 805d1875650f04b46e8fcdc7e9a8d32932e395398e8a8dc2d8aaeb82665a127f
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
available
Fingerprint: 596c214e60f67af37a9e8175e4f5cd1a8ccaa6da5d5c0b2911f426d14b9208a6