What is CVE-2025-4318?

CVE-2025-4318 is a vulnerability in Amazon Amplify Studio, classified under Eval Injection. Published 2025-05-05.

Is CVE-2025-4318 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Amazon Amplify Studio

CVE-2025-4318

The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.

EPSS: 0.010 (60.1th percentile) — read the EPSS interpretation.

Affected products

Amazon Amplify Studio — versions 0.1.0

Weakness classification (CWE)

CWE-95 — Eval Injection

Public proof-of-concept exploits

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-4318?: CVE-2025-4318 is a vulnerability in Amazon Amplify Studio, classified under Eval Injection. Published 2025-05-05.
Is CVE-2025-4318 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.