Vulnerabilities in pkg:npm/jsii-diff

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wcx4-wpfv-mc5c",
  "modified" : "2026-08-07T18:15:47Z",
  "published" : "2026-08-07T18:15:47Z",
  "aliases" : [ "CVE-2026-15895" ],
  "summary" : "jsii-diff: Command Injection via npm: package argument",
  "details" : "## Summary\n\njsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool.\n\n## Impact\njsii-diff supports downloading packages to compare directly from NPM, so that you can compare a proposed candidate version of your jsii package with an already-published version, by passing an argument that looks like `npm:<package-specifier>`. For example:\n\n```\njsii-diff npm:my-package@latest .\n```\n\nBy injecting a `;` into the `package-specifier` part of that command, jsii-diff can be tricked into running shell commands. For example:\n\n```\njsii-diff \"npm:lodash; touch /tmp/123\" .\n```\n\nThis allows anyone that can control the command-line arguments to jsii-diff to run arbitrary commands with the same permissions as the jsii-diff command itself.\n\n## Patches\nThis issue has been addressed in jsii-diff version 1.131.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n## Workarounds\nIf you are unable to update, make sure only trusted actors can control the arguments passed to jsii-diff.\n\n## References\nIf you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "jsii-diff"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.131.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/aws/jsii/security/advisories/GHSA-wcx4-wpfv-mc5c"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-15895"
  }, {
    "type" : "WEB",
    "url" : "https://aws.amazon.com/security/security-bulletins/2026-057-aws"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/aws/jsii"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/aws/jsii/releases/tag/v1.131.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-07T18:15:47Z",
    "nvd_published_at" : null
  }
}