Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@aws-amplify/codegen-ui-react

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.5npmAmendedPublished

    AWS Amplify Studio UI Component Properties Has an Input Validation Issue

    CVE-2025-4318 · GHSA-hf3j-86p7-mfw8

    Affected
    • npm @aws-amplify/codegen-ui-react <= 2.20.2
    Fixed in
    2.20.3· Vendor fix available
    Issue
    The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS CLI) for generating component files in customers' local applications. An issue exists in the Amplify Studio property binding process of the amplify-codegen-ui package that could potentially allow an authenticated user to run arbitrary JavaScript code during the component rendering and build process. Impact When importing a component schema using the create-component command, Amplify Studio will import and generate the component on the users' behalf. The expression-binding function does not validate the component schema properties before converting them to expressions. As a result, an authenticated user who can create or modify components could run arbitrary JavaScript code during the component rendering and build process. Impacted…

    Recommended action: Upgrade to 2.20.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →