Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

cdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.7npmAmendedPublished

    AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

    CVE-2025-2598 · GHSA-v63m-x9r9-8gqp

    Affected
    • npm cdk >= 2.172.0, < 2.178.2
    Fixed in
    2.178.2· Vendor fix available
    Issue
    The AWS Cloud Development Kit (AWS CDK) [1] is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. The AWS CDK CLI [2] is a command line tool for interacting with CDK applications. Customers can use the CDK CLI to create, manage, and deploy their AWS CDK projects. An issue exists in the AWS CDK CLI where, under certain conditions, AWS credentials may be returned in the console output. Plugins that return an expiration property in the credentials object are affected by this issue. Plugins that omit the expiration property are not affected. Impact When customers run AWS CDK CLI commands with credential plugins and configure those plugins to return temporary credentials by including an expiration property, the AWS credentials retrieved by the plugin may be returned in the console output. Any user with access where the CDK CLI was ran would have access to this output. The following are examples of…

    Recommended action: Upgrade to 2.178.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →