HackerOne Disclosed Reports - 2026-11-09

High
resolved

SQL Injection via Unsanitized Identifiers and String Literals in `@aws-cdk/aws-redshift-alpha` Custom Resource Handlers

Bug reported by Joseph Semaan was disclosed at November 9, 2026, 6:53 pm   |   SQL Injection

A SQL injection vulnerability was discovered in custom resource handlers within the AWS CDK Redshift Alpha module. The vulnerability resulted from unsanitized identifiers and string literals in SQL queries, which allowed malicious input to be executed as SQL commands. The issue was remediated following responsible disclosure coordination.