Bulletin ID: 2026-162-AWS
Publication Date: 11/02/2026 09:30 AM PST
Description:
Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development environments, and developers provision them on demand through a web portal. We identified CVE-2026-119085, where improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role.
Impacted versions: All commits before c146486 (PR #31, merged 2026-05-04)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the original article:
CVE-2026-119085 – Template injection in the publishing component of Virtual Engineering Workbench