aws-cdk

AWS CDK Toolkit CLI, the command line tool for CDK apps

Latest 2.1145.0

91%

Total Score

healthy

Frequent releases, active AWS-backed development, and verified provenance make this a mature release with only minor workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 19 workflows were analyzed, with job-level permissions in every workflow and no top-level write permissions. However, two workflows combine untrusted checkouts with pull_request_target or workflow_run contexts, 84 of 190 action references are unpinned, and the audit found high-confidence adhoc package installs; these are release-process hygiene concerns, not evidence of an unfit package.

Vulnerabilities

Title	Versions	Severity
CVE-2025-2598 aws-cdk is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in versions 2.172.0 - 2.178.2.	2.172.0 - 2.178.2	Medium
CVE-2024-45037 aws-cdk is vulnerable to Incorrect Authorization in versions 2.142.0 - 2.148.0.	2.142.0 - 2.148.0	Medium
AIKIDO-2024-10005 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. aws-cdk is vulnerable to Log injection in versions 2.109.0 - 2.129.0.	2.109.0 - 2.129.0	Low