aws-cdk-lib

Version 2 of the AWS Cloud Development Kit library

Latest 2.272.0

NPM

94%

Total Score

healthy

Healthy: sustained maintenance and strong project backing outweigh minor workflow-pinning and audit-coverage concerns.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is reported, which leaves release origin less independently verifiable despite the package's strong maintenance evidence.

Workflow audit

The audit found all 72 action references unpinned and analyzed only 30 of 48 workflows, which weakens build reproducibility and leaves coverage incomplete. The four reported cache-poisoning findings were low-confidence, so they are hygiene concerns rather than severe evidence on their own.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-577363 aws-cdk-lib is vulnerable to OS Command Injection in versions 0.0.1 - 2.259.0.	0.0.1 - 2.259.0	High
CVE-2026-11417 aws-cdk-lib is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 2.246.0.	0.0.0 - 2.246.0	High
AIKIDO-2025-10249 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. aws-cdk-lib is vulnerable to Incorrect Execution-Assigned Permissions in versions 2.0.0 - 2.189.0.	2.0.0 - 2.189.0	Low
AIKIDO-2025-10191 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. aws-cdk-lib is vulnerable to Incorrect Default Permissions in versions 2.0.0 - 2.183.0.	2.0.0 - 2.183.0	Medium
CVE-2025-23206 aws-cdk-lib is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.0 - 2.177.0.	0.0.0 - 2.177.0	Low