Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119085— Template injection in the publishing component of awslabs Virtual Engineering Workbench

Quick assessment

Affected
AWS virtual-engineering-workbench
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Amazon 虚拟工程工作台（Virtual Engineering Workbench，简称 VEW）发布组件中的模板引擎未能正确中和特殊元素，可能导致经过身份验证的远程第三方利用该漏洞，以发布组件所关联的 Lambda 函数 IAM 角色的权限执行任意代码。攻击者可借此访问所有租户项目中的数据与资源。该漏洞可通过提交包含恶意模板引擎指令的伪造 CloudFormation 模板主体，经由产品版本管理 API 触发。 为修复此问题，用户应基于 awslabs/virtual-engineering-workben

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
AWS virtual-engineering-workbench < c146486cec41f5b04fae57e9ce1a7fb40e695615 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119085

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Template injection in the publishing component of awslabs Virtual Engineering Workbench
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AWS virtual-engineering-workbench 0 ~ c146486cec41f5b04fae57e9ce1a7fb40e695615 -

II. Public POCs for CVE-2026-119085

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119085

请登录查看更多情报信息。

Other References for CVE-2026-119085 (2)

Same Patch Batch · AWS · 2026-11-02 · 4 CVEs total

CVE-2026-119301 7.9 HIGH Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in A
CVE-2026-116635 6.1 MEDIUM Improper limitation of a pathname to a restricted directory in the deployment status compo
CVE-2026-120497 5.0 MEDIUM Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-D

IV. Related Vulnerabilities

Same vendor: AWS
Same weakness: CWE-1336