Code Generation Vulnerability in AWS Amplify Codegen UI React
CVE-2026-18245

6.4MEDIUM

Key Information:

Vendor

Aws

Status
Amplify Codegen Ui
Vendor
CVE Published:
30 July 2026

What is CVE-2026-18245?

The AWS Amplify Codegen UI for React prior to version 2.20.6 contains a vulnerability that allows remote authenticated users to potentially execute arbitrary code. This issue arises from insufficient input validation related to crafted component and theme schema values. The flawed validation can be exploited in various contexts, including end-user browsers, developer machines, CI/CD environments, and server-side rendering settings. Upgrading to version 2.20.6 is recommended to mitigate these risks.

Affected Version(s)

Amplify Codegen UI 0 < 2.20.6

References

https://github.com/aws-amplify/amplify-codegen-ui/release...
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/aws-amplify/amplify-codegen-ui/securit...
third-party-advisory

CVSS V4

Score:
6.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.