{"action":"Upgrade @aws-amplify/codegen-ui-react to 2.20.3 or later.","affected":[{"fixed":"2.20.3","introduced":"0"}],"component":"@aws-amplify/codegen-ui-react","cve_ids":["CVE-2025-4318"],"ecosystem":"npm","epss":0.00993,"exploited":false,"fixed_versions":["2.20.3"],"ghsa_id":"GHSA-hf3j-86p7-mfw8","id":"tcs_01M5KFTTKN4V5K9ZSG465EKY8B","modified_at":"2026-07-30T21:00:29.843439613Z","published_at":"2026-07-30T20:57:24Z","references":["https://osv.dev/vulnerability/GHSA-hf3j-86p7-mfw8","https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8","https://nvd.nist.gov/vuln/detail/CVE-2025-4318","https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6","https://aws.amazon.com/security/security-bulletins/AWS-2025-010","https://blog.securelayer7.net/cve-2025-4318-aws-amplify-rce","https://github.com/aws-amplify/amplify-codegen-ui","https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-hf3j-86p7-mfw8","url":"https://osv.dev/vulnerability/GHSA-hf3j-86p7-mfw8"},{"source":"nvd","source_id":"CVE-2025-4318","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4318"}],"summary":"AWS Amplify Studio UI Component Properties Has an Input Validation Issue"}