🟠 High | Source: AWS Security Bulletins
An incomplete fix has been identified for CVE-2025-4318, a code injection vulnerability in Amazon’s @aws-amplify/codegen-ui-react library, which is used to auto-generate React UI components from Amplify Studio data models. The original patch did not fully remediate the vulnerability, meaning applications relying on the earlier fix may still be exposed to arbitrary code execution risks. Developers using this package should review the updated AWS Security Bulletin and apply the latest remediation immediately.
Security Architect’s Take: Audit your CI/CD pipelines and front-end build processes for any use of @aws-amplify/codegen-ui-react and ensure you are running the latest patched version referenced in the updated bulletin — do not assume the previously applied fix is sufficient. Consider adding dependency scanning (e.g. via Dependabot or Snyk) to catch incomplete upstream patches more rapidly in future.
Original advisory: Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react