Improper neutralization of special elements used in an OS command

CVE-2026-85012 is an OS command injection (CWE-78) in the Amazon CodeCatalyst Blueprints SDK prior to version 0.3.156. The owner field of a [local] merge strategy entry in the .ownership-file is passed unsanitized to a shell command during the blueprint resynthesis process. An authenticated project contributor who can commit to the repository can embed shell metacharacters in that field. When resynthesis is triggered (requiring another user's action), the injected commands execute in the resynthesis environment with whatever privileges that process holds.

The vendor scored this HIGH at 8.0, but that rating dramatically overstates the real-world risk. The managed Amazon CodeCatalyst service is not vulnerable — AWS applies server-side validation that rejects [local] merge strategy commands outside a restricted allowlist, even for blueprint versions published before the fix. The only affected population is organizations running the open-source SDK in self-hosted environments, a group so small the core npm package sees roughly 919 weekly downloads. Even in that niche, resynthesis typically runs in an isolated per-project environment with scoped credentials, capping blast radius. The vendor HIGH is defensible as a theoretical maximum, but the real-world exposure population is vanishingly small.

Why this verdict

• Managed service immunity eliminates >95% of the user base: AWS confirmed that the CodeCatalyst managed service applies server-side allowlist validation on [local] merge strategy commands, rendering this CVE unexploitable for the vast majority of users regardless of SDK version.
• Microscopic self-hosted install base: The core Blueprints SDK npm package has ~919 weekly downloads. Even assuming private registry mirrors, the self-hosted population is negligibly small for enterprise fleet-scale risk.
• Authentication + user interaction compounding friction: The chain requires PR:L (authenticated project contributor) AND UI:R (a separate user must trigger resynthesis). This is not a spray-and-pray attack; it requires insider positioning or compromised developer credentials, then passive waiting.
• Scope:Unchanged caps blast radius: The CVSS vector specifies S:U, meaning even the vendor does not expect the attacker to break out of the resynthesis environment boundary. Best-practice deployments use isolated containers with scoped credentials.
• Role multiplier: CI/CD-adjacent component with caveats. The Blueprints SDK is CI/CD-adjacent (resynthesis generates project scaffolding), placing it in the high-value role catalog. However: (1) the managed service is immune, so the canonical CI/CD deployment is not affected; (2) self-hosted SDK users running resynthesis in production CI pipelines without sandboxing represent a tiny fraction of an already tiny install base; (3) even in the worst case, S:U and scoped credentials limit blast radius to the project, not the fleet. The CI/CD role multiplier would floor this at HIGH if the canonical deployment were affected — but it is not. The floor does not apply because <1% of the installed base occupies the vulnerable configuration.

Why not higher?

Upgrading to HIGH or CRITICAL would require either the managed service to be vulnerable (it is not), a meaningfully large self-hosted population (npm data shows ~919 weekly downloads), or evidence of active exploitation or public PoC availability (neither exists). The CI/CD role multiplier is neutralized because the canonical deployment path — the managed CodeCatalyst service — is explicitly immune per AWS's own bulletin.

Why not lower?

Despite the tiny exposure population, this remains a real OS command injection (CWE-78) with full C/I/A impact in the resynthesis environment. The attack is conceptually simple (shell metacharacters in a config field) and requires only low privileges. Some enterprises may run self-hosted Blueprints SDK in CI pipelines with overprivileged service accounts, and the fix is a simple npm upgrade. Dropping to LOW or IGNORE would understate the risk for the small population that IS affected.

1. Upgrade to SDK version 0.3.156 immediately — This is a one-line npm update for self-hosted users. The fix removes shell interpretation entirely and adds allowlist validation. Given the MEDIUM verdict, this falls under the noisgate 365-day remediation SLA, but the simplicity of the fix means there is no reason to delay.
2. Audit .ownership-file contents in all repositories using the Blueprints SDK — Search for shell metacharacters ($, backticks, ;, |, &) in the owner field of [local] merge strategy entries. This is a one-time grep across your CodeCatalyst-connected repositories to confirm no exploitation has occurred.
3. Run resynthesis in isolated containers with scoped credentials — If you must remain on a pre-0.3.156 SDK version temporarily, ensure the resynthesis process runs in a sandboxed container (Docker, Firecracker) with minimal IAM permissions scoped to the single project. This limits blast radius even if injection occurs.
4. Add pre-commit hooks to reject suspicious .ownership-file changes — A simple git pre-commit or CI check that flags .ownership-file modifications containing shell metacharacters will block the attack vector at the commit layer.

Run this on any host where the CodeCatalyst Blueprints SDK is installed (typically a CI runner or developer workstation). Execute as the user who runs npm: bash check_cve_2026_85012.sh. No elevated privileges required.

#!/usr/bin/env bash
# check_cve_2026_85012.sh
# Checks whether the installed @amazon-codecatalyst/blueprints.blueprint
# npm package is vulnerable to CVE-2026-85012 (OS command injection
# in blueprint resynthesis via .ownership-file owner field).
# Fixed in version 0.3.156.
#
# Exit codes:
#   0 = PATCHED or package not installed
#   1 = VULNERABLE
#   2 = UNKNOWN (could not determine version)

set -euo pipefail

PKG="@amazon-codecatalyst/blueprints.blueprint"
FIXED_VERSION="0.3.156"

# Check if npm is available
if ! command -v npm &>/dev/null; then
  echo "UNKNOWN - npm not found on this host. If the Blueprints SDK is not used here, this host is not affected."
  exit 2
fi

# Get installed version (global and local)
INSTALLED=$(npm ls "$PKG" --json 2>/dev/null | grep '"version"' | head -1 | sed 's/.*"version": *"\([^"]*\)".*/\1/' || true)

if [ -z "$INSTALLED" ]; then
  echo "PATCHED - Package $PKG is not installed on this host."
  exit 0
fi

echo "Found $PKG version: $INSTALLED"

# Compare versions using sort -V
LOWER=$(printf '%s\n%s' "$INSTALLED" "$FIXED_VERSION" | sort -V | head -1)

if [ "$LOWER" = "$INSTALLED" ] && [ "$INSTALLED" != "$FIXED_VERSION" ]; then
  echo "VULNERABLE - $PKG $INSTALLED is below fixed version $FIXED_VERSION (CVE-2026-85012)"
  exit 1
else
  echo "PATCHED - $PKG $INSTALLED is at or above fixed version $FIXED_VERSION"
  exit 0
fi

Sources

1. AWS Security Bulletin 2026-001
2. CVE-2026-85012 - Offseq Radar
3. CVE-2026-85012 - VulDB
4. CVE-2026-85012 - ThreatInt
5. npm: @amazon-codecatalyst/blueprints.blueprint - Socket.dev
6. npm: @amazon-codecatalyst/blueprints.blueprint
7. CWE-78: OS Command Injection