AmazonAnalysisAmazon Web Services patches SAM CLI Terraform hook command injection flaw
What happened.Amazon Web Services published security bulletin 2026-145-AWS detailing a resolved command injection defect inside the Serverless Application Model CLI Terraform build hook.
Why it matters.Serverless build utilities run inside developer environments and continuous integration pipelines with access to cloud credentials. Command injection vulnerabilities in common deployment hooks allow untrusted repository changes to exfiltrate pipeline secrets. Engineering teams should audit SAM CLI versions across local workstations and containerized runners.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-115414 with an 8.6 CVSS score, improper shell parameter handling in generated Makefile recipes allows arbitrary command execution during local builds.
- Exploitation path: Malicious Terraform resource definitions or untrusted configuration plans processed by the build toolchain run unauthorized commands with the privileges of the local build operator.
- Remediation releases: AWS fixed the interpolation defect in SAM CLI version 1.166.2, advising development teams to upgrade global package installations and CI build container dependencies.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: