CVE-2026-15895: jsii-diff: Command Injection via npm: package argument

August 7, 2026

jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool.

References

aws.amazon.com/security/security-bulletins/2026-057-aws
github.com/advisories/GHSA-wcx4-wpfv-mc5c
github.com/aws/jsii/releases/tag/v1.131.0
github.com/aws/jsii/security/advisories/GHSA-wcx4-wpfv-mc5c
nvd.nist.gov/vuln/detail/CVE-2026-15895

Code Behaviors & Features

Detect and mitigate CVE-2026-15895 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →