AWS Amplify Codegen UI React CVE-2026-18245 Arbitrary JS Execution Patched in 2.20.6

AWS has released version 2.20.6 of the @aws-amplify/codegen-ui-react library to address a code injection vulnerability. This update resolves an issue where authenticated users could execute arbitrary JavaScript during component rendering.

What happened

The vulnerability, tracked as CVE-2026-18245, exists within the amplify-codgen-ui-react package. According to the AWS Security Bulletin published on 30 July 2026, the flaw permits authenticated users to run arbitrary JavaScript code. This execution occurs during the component rendering and build process of AWS Amplify projects.

Amplify Codegen UI generates React components and themes from schema definitions. The bulletin title references CVE-2025-4318, indicating this is an incomplete fix for that prior issue. George Chen reported the current issue through the coordinated disclosure process. AWS classifies the bulletin as important and requiring attention.

Why it matters

Security teams managing AWS Amplify projects must verify their library versions immediately. The ability to execute arbitrary JavaScript during the build process poses significant integrity risks. Attackers with authenticated access could inject malicious code into generated components. This could compromise the application logic during the rendering phase.

The bulletin references CVE-2025-4318 in its title, suggesting the previous fix was incomplete. Consequently, environments relying on older versions remain exposed to this code injection vector. There are no workarounds available other than upgrading to the patched version. Forked or derivative code must also be updated to incorporate the new fixes.

Next steps

• Audit all AWS Amplify projects for the @aws-amplify/codegen-ui-react package.
• Identify any forked or derivative code that may not receive automatic updates.
• Upgrade to version 2.20.6 to apply the security patch.
• Verify that the build process does not execute untrusted schema definitions.

Detection notes

Teams usually monitor build logs for unexpected JavaScript execution or syntax errors during the rendering phase. Check whether authenticated users have triggered anomalous component generation requests. Look for deviations in the expected output of React components after schema processing. Analysts should inspect network traffic for unusual data exfiltration during the build pipeline. Containment moves involve isolating affected build servers and revoking credentials for suspicious accounts. Review access logs to identify any unauthorised schema submissions that could trigger code injection.

What to do and how to stay safe: AWS

• Review dependency manifests to confirm the installed version of @aws-amplify/codegen-ui-react.
• Restrict schema definition inputs to trusted sources only to reduce injection surface.
• Monitor build server logs for signs of arbitrary JavaScript execution attempts.
• Plan to upgrade to version 2.20.6 once the vendor provides the update in your pipeline.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this code injection flaw?

The vulnerability is tracked as CVE-2026-18245.

Which version fixes the issue?

Version 2.20.6 of @aws-amplify/codegen-ui-react addresses the flaw.

Are there any workarounds?

No workarounds are available; upgrading to version 2.20.6 is required.