10 hours ago
High
resolved
resolved
SQL Injection via Unsanitized Identifiers and String Literals in `@aws-cdk/aws-redshift-alpha` Custom Resource Handlers
Bug reported by Joseph Semaan was disclosed at November 9, 2026, 6:53 pm | SQL Injection
A SQL injection vulnerability was discovered in custom resource handlers within the AWS CDK Redshift Alpha module. The vulnerability resulted from unsanitized identifiers and string literals in SQL queries, which allowed malicious input to be executed as SQL commands. The issue was remediated following responsible disclosure coordination.