CVE-2026-119085

High

Description

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.

SeverityHigh

CVSS8.8

Exploit probability—

ProductAws Virtual-engineering-workbench

PublishedNov 2, 2026

First seenNov 4, 2026

Weakness typeCWE-1336CWE-1336

How to fix

Update

AWS virtual-engineering-workbenchc146486cec41f5b04fae57e9ce1a7fb40e695615 or later

Patches

github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615

Vendor advisories

aws.amazon.com/security/security-bulletins/2026-162-aws/

Affected products

Product	Affected versions	Fixed in
AWS virtual-engineering-workbench	v < c146486cec41f5b04fae57e9ce1a7fb40e695615	c146486cec41f5b04fae57e9ce1a7fb40e695615

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.