by Kastro
Paper/Archive/CVE-2025-4318

CVE-2025-4318

Amazon Amplify Studio — Input validation issue in AWS Amplify Studio UI component properties

EPSS 1.0%public exploitCVSS 9.0
critical.is priorityof 100
49
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 62.1.621 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

Affected

ProductAffectedFixed inSource
Amplify Studio0.1.0 – < 2.20.32.20.3CNA

Scores by source

AMZN (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisoryaws.amazon.com/security/security-bulletins/AWS-2025-010patchgithub.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3advisorygithub.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8exploitblog.securelayer7.net/cve-2025-4318-aws-amplify-rcerefgithub.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6