Is CVE-2026-107608 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107608?

CVE-2026-107608 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-107608

Description

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or later.