A high-severity command injection vulnerability in Amazon CodeCatalyst blueprints allows authenticated users with repository commit permissions to execute arbitrary code within the resynthesis environment.

This is an OS command injection flaw (CWE-78) occurring in the blueprint resynthesis framework, where improper sanitization of shell metacharacters in the owner field of a local merge strategy entry allows an authenticated user to bypass security restrictions.

The ability to execute arbitrary OS commands poses a severe risk to project integrity and environment security. While the impact is contained within an isolated per-project environment, a successful exploit could lead to unauthorized data access, modification of project configurations, or escalation of privileges within the build pipeline. The CVSS score of 8.0 reflects the significant potential for impact on confidentiality, integrity, and availability within the affected development lifecycle.

Immediate Action: Upgrade the @amazon-codecatalyst/blueprints.blueprint package to version 0.3.156 or later to enforce proper command validation and remove shell interpretation.

Proactive Monitoring: Review repository commit logs for unusual or suspicious entries in .ownership-file configurations, particularly those containing shell metacharacters or unauthorized owner fields.

Compensating Controls: Ensure that development workflows adhere to the principle of least privilege by restricting repository commit access to only necessary personnel, thereby limiting the pool of potential attackers.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, organizations utilizing the affected blueprint framework should prioritize the update to version 0.3.156. While Amazon notes that server-side validation is applied within the managed CodeCatalyst service, users maintaining custom or self-hosted implementations of the blueprint framework must apply the provided patch immediately to close the injection vector and secure their development environment.