Vulnerability · Published May 5, 2025 · Assigned by AMZN
CVE-2025-4318Input validation issue in AWS Amplify Studio UI component properties
Critical 9.0
In plain English
A critical-severity security flaw in Amplify Studio from Amazon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @aws-amplify/codegen-ui-react | 2.20.3 | GHSA-hf3j-86p7-mfw8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Amplify Studio | 0.1.0 – before 2.20.3 |
Weakness: CWE-95 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-010/ vendor-advisory
- https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3 patch
- https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8 vendor-advisory
- https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce/ exploit
- https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6