Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

jsii-diff

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.4npmPublished

    jsii-diff: Command Injection via npm: package argument

    CVE-2026-15895 · GHSA-wcx4-wpfv-mc5c

    Affected
    • npm jsii-diff < 1.131.0
    Fixed in
    1.131.0· Vendor fix available
    Issue
    jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impact jsii-diff supports downloading packages to compare directly from NPM, so that you can compare a proposed candidate version of your jsii package with an already-published version, by passing an argument that looks like npm:<package-specifier. For example: By injecting a ; into the package-specifier part of that command, jsii-diff can be tricked into running shell commands. For example: This allows anyone that can control the command-line arguments to jsii-diff to run arbitrary commands with the same permissions as the jsii-diff command itself. Patches This issue has been addressed in jsii-diff version 1.131.0. We recommend upgrading to the latest version and ensuring any forked or…

    Recommended action: Upgrade to 1.131.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →