AWS SAM CLI Terraform Hook Contains Command Injection Flaw

The vulnerability affects CLI versions 1.63.0 to 1.166.1, enabling potential arbitrary command execution during build processes.

Updated on Oct. 23, 2026 in Cybersecurity

AWS SAM CLI Terraform Hook Contains Command Injection Flaw

Live Poll

Do you trust that widely used open-source developer tools are secure enough for your daily work?

Security researchers have identified an OS command injection vulnerability, tracked as CVE-2026-115414, within the AWS SAM CLI. The flaw affects the tool's Terraform hook, potentially allowing unauthorized command execution by the build user.

Why it matters

This vulnerability impacts development workflows relying on automated build processes, as it enables arbitrary command execution if an attacker can influence the Terraform configuration or plan file.

The vulnerability affects AWS SAM CLI versions 1.63.0 through 1.166.1. It specifically targets the sam build -hook-name terraform command, which fails to neutralize shell metacharacters during Makefile generation.

The players

AWS SAM CLI

An open-source command-line tool used for building, testing, and deploying serverless applications on Amazon Web Services.

The details

The vulnerability stems from how the AWS SAM CLI Terraform hook generates a Makefile recipe. When the hook interpolates a Terraform resource address, it fails to neutralize shell metacharacters—special characters that trigger specific actions in a command-line interface. Consequently, if a malicious actor controls the Terraform configuration or plan file, they can inject arbitrary commands that execute with the permissions of the build user.

October 23, 2026: CVE-2026-115414 vulnerability report published.

The Tech Race

This discovery follows a pattern seen in the 2021 Log4j shell injection vulnerability where insufficient character neutralization in configuration-driven tools enables arbitrary execution. It highlights the security risks inherent in build automation pipelines that integrate disparate infrastructure-as-code platforms.

Developers using AWS SAM CLI versions 1.63.0 through 1.166.1 should audit their Terraform build hooks immediately. This flaw poses a risk to any build environment where Terraform configuration files are sourced from untrusted or externally influenced locations.

The takeaway

Users should verify if their current environment is running an affected version of the AWS SAM CLI. Monitor future security bulletins for patch releases that address the failure to neutralize shell metacharacters in the Terraform hook.