Dashboard / CVE-2026-119085

CVE-2026-119085

CRITICAL
INFO Priority: 0.05 BB Relevance: 69/100
Published: 2026-11-02 Modified: 2026-11-03 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
AWS virtual-engineering-workbench 0 < c146486cec41f5b04fae57e9ce1a7fb40e695615
AWS virtual-engineering-workbench 0 < c146486cec41f5b04fae57e9ce1a7fb40e695615
AWS virtual-engineering-workbench 0 < c146486cec41f5b04fae57e9ce1a7fb40e695615

References & Advisories (3)

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.48%
Raw Score 0.004810
Percentile 41.5%
Date 2026-11-03

Intelligence Sources

mitre ref →
nvd ref →

External Links