aws-cdk-lib

Version 2 of the AWS Cloud Development Kit library

Latest 2.273.0

NPM

91%

Total Score

healthy

Frequent releases, active contributors, and strong package documentation outweigh workflow pinning gaps.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's otherwise strong project evidence.

Workflow audit

The audit is incomplete because only 30 of 48 workflows were analyzed. All 72 action references are unpinned, and one pull_request_target workflow performs an untrusted checkout; the four cache-poisoning findings are low confidence and therefore hygiene concerns rather than decisive risks.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-577363 aws-cdk-lib is vulnerable to OS Command Injection in versions 0.0.1 - 2.259.0.	0.0.1 - 2.259.0	High
CVE-2026-11417 aws-cdk-lib is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 2.246.0.	0.0.0 - 2.246.0	High
AIKIDO-2025-10249 aws-cdk-lib is vulnerable to Incorrect Execution-Assigned Permissions in versions 2.172.0 - 2.189.0.	2.172.0 - 2.189.0	Low
AIKIDO-2025-10191 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. aws-cdk-lib is vulnerable to Incorrect Default Permissions in versions 2.0.0 - 2.183.0.	2.0.0 - 2.183.0	Medium
CVE-2025-23206 aws-cdk-lib is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.0 - 2.177.0.	0.0.0 - 2.177.0	Low