CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook
// summary
CVE-2026-115414 describes an OS command injection issue in AWS SAM CLI's Terraform hook, where resource addresses are interpolated into generated Makefile recipes.
// from the source
Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an open-source framework for building serverless applications. We identified CVE-2026-115414, an OS command injection issue in the Terraform hook (sam build --hook-name terraform) in AWS SAM CLI. The Terraform hook generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters, which cou