CVE-2026-15895: jsii-diff: Command Injection via npm: package argument

August 7, 2026

jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool.

References

aws.amazon.com/security/security-bulletins/2026-057-aws
github.com/advisories/GHSA-wcx4-wpfv-mc5c
github.com/aws/jsii/releases/tag/v1.131.0
github.com/aws/jsii/security/advisories/GHSA-wcx4-wpfv-mc5c
nvd.nist.gov/vuln/detail/CVE-2026-15895

Code Behaviors & Features

Detect and mitigate CVE-2026-15895 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →