CVE-2025-4318 Input validation issue in AWS Amplify Studio UI component properties
Authenticated users can execute arbitrary JavaScript code via unvalidated UI component property expressions in AWS Amplify Studio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4318?
CVE-2025-4318 is a critical code injection vulnerability in Amazon Amplify Studio, published on 5 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
Weakness: CWE-95
Which versions are affected by CVE-2025-4318?
2 open source packages ship an affected version, including @aws-amplify/codegen-ui-react.
| Package | Affected | Fixed in |
|---|---|---|
@aws-amplify/codegen-ui-react npm | All versions | 2.20.3 |
@aws-amplify/codegen-ui-react npm | All versions | 2.20.3 |
How do I fix CVE-2025-4318?
Upgrade @aws-amplify/codegen-ui-react to 2.20.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-4318 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4318 exists.
Sources
Also known as GHSA-hf3j-86p7-mfw8.