CVE-2026-119085

Description

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

Overview

State: PUBLISHED
Assigner (CNA): AMZN
CVSS severity: CRITICAL
CVSS score: 9.4 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Effective score: 9.4 / 10 CRITICAL source: CNA overview
CWE(s): CWE-1336
Reserved: 2026-10-29
Published: 2026-11-02 17:37 UTC
Last updated: 2026-11-02 19:08 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119085.json
Linked Threat: CVE-2026-119085 — Template injection in the publishing component of awslabs Virtual Engineering Workbench

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-02 18:18:44 UTC
NVD last modified: 2026-11-02 19:34:23 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115348

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
AWS	virtual-engineering-workbench	`0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://aws.amazon.com/security/security-bulletins/2026-162-aws/ ff89ba41-3aa1-4d27-914a-91399e9639e5
https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615 ff89ba41-3aa1-4d27-914a-91399e9639e5

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-119085 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No solution or workaround provided in the CVE record. OpenCVE Recommended Actions Redeploy Amazon Virtual Engineering Workbench from the most recent release available on the awslabs repository to apply the vendor patch Review and limit the IAM permissions granted to the publishing Lambda function to the minimum required for operation

2026-11-03 08:23 UTC
CVE-2026-119085 - Template injection in the publishing component of ...

web:aws.amazon.com

We identified CVE-2026-119085 , where improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role.

2026-11-03 08:23 UTC
CVE-2026-119085: AWS Vulnerability (CVSS 8.8) | CVETodo

web:cvetodo.com

CVE-2026-119085 is a CVSS 8.8 high-severity vulnerability in Virtual Engineering Workbench. Includes technical details, affected versions, and mitigation steps.

2026-11-03 08:23 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-03 08:23 UTC
CVE-2026-119085 - Remote Code Execution in Amazon Virtual…

web:vulmon.com

Vulnerability Summary A vulnerability in the publishing component of Amazon Virtual Engineering Workbench (VEW) enables a remote authenticated third party to execute arbitrary code. This code runs with the permissions of the publishing Lambda's IAM role, potentially granting access to data and resources across all tenant projects. The flaw is triggered by a crafted CloudFormation template body ...

2026-11-03 08:23 UTC
CVE-2026-119085 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-119085 🗓️ 02 Nov 2026 09:37:08 Reported by AMZN Type cve 🔗 web.nvd.nist.gov 👁 5 Views

2026-11-03 08:23 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.

2026-11-03 08:23 UTC
Patch Smarter, Not Harder - CISA

web:www.cisa.gov

The median time for full resolution rose to 43 days. Defenders need greater clarity and speed to patch systems in today's threat landscape. We must flip the script on patching prioritization: patch smarter, not harder.

2026-11-03 08:23 UTC
CVE-2026-119085 - Detail CVSS, EPSS & CISA Kev | CVE Find

web:www.cvefind.com

Full details for CVE-2026-119085 : technical description, impact, CVSS/EPSS scores, linked CWE, CAPEC, affected CPEs, disclosure date, and mitigation options.

2026-11-03 08:23 UTC
CVE-2026-119085: Server-Side Template Injection (SSTI) - Analysis & Fix ...

web:www.thehackerwire.com

How do I fix or mitigate CVE-2026-119085 ? To protect against CVE-2026-119085 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-11-03 08:23 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-119085.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119085",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T19:08:37.497229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T19:08:55.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "virtual-engineering-workbench",
          "vendor": "AWS",
          "versions": [
            {
              "lessThan": "c146486cec41f5b04fae57e9ce1a7fb40e695615",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:virtual-engineering-workbench:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "c146486cec41f5b04fae57e9ce1a7fb40e695615",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CyStack"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.</p><p>To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.</p>"
            }
          ],
          "value": "Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.\n\n\n\nTo remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336 Improper neutralization of special elements used in a template engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T17:37:08.585Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-162-aws/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Template injection in the publishing component of awslabs Virtual Engineering Workbench",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-119085",
    "datePublished": "2026-11-02T17:37:08.585Z",
    "dateReserved": "2026-10-29T13:17:57.150Z",
    "dateUpdated": "2026-11-02T19:08:55.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}