Summary
- CVE-2026-115414 affects AWS SAM CLI versions 1.63.0 to 1.166.1 when using the Terraform hook.
- Maliciously influenced Terraform input can reach generated build commands and execute in the build environment.
- AWS fixed the issue in SAM CLI 1.166.2 and recommends reviewing trusted build inputs and third-party modules.
Amazon Web Services has released a security update for the Terraform integration in SAM CLI, correcting a command injection vulnerability that could allow maliciously influenced build inputs to execute commands on the system performing the build. The flaw affects a conditional part of the serverless development workflow rather than every use of Terraform or every AWS Lambda application.
Security bulletin 2026-145-AWS, published on 22 October, tracks the flaw as CVE-2026-115414. AWS says the affected versions range from SAM CLI 1.63.0 through 1.166.1, with a fix available in version 1.166.2. The specific path involves the Terraform hook invoked when SAM CLI builds a project configured to use Terraform resources.
SAM CLI is a development tool for building and testing serverless applications. Its Terraform integration translates relevant infrastructure definitions into instructions needed to prepare application artifacts. The vulnerability arose because generated Makefile recipes incorporated a Terraform resource address without fully neutralising characters that have special meaning to a shell.
According to AWS and the accompanying GitHub advisory, an actor who can influence the Terraform configuration or plan file consumed by the build could craft an input that causes commands to run with the privileges of the build user. The flaw does not establish that a remote visitor can directly compromise any internet-accessible SAM CLI installation without first affecting those inputs.
The risk becomes more consequential in automated build environments because build users may have access to repository tokens, package registry credentials, cloud service configuration and other secrets. If an attacker controls part of a build dependency or a file that the pipeline will process, the affected hook could provide a route from apparently declarative infrastructure data to executable instructions.
The GitHub advisory notes that malicious commands can run during the build even if that build later fails. Treating a failed build as proof that no commands were executed would therefore be unsafe. Likewise, routine testing of the finished application may not show whether the build environment performed unexpected actions before producing or rejecting an artifact.
The weakness fits a recurring pattern in developer tooling: metadata and configuration supplied for one purpose can become unsafe when inserted into another interpreter. Terraform resource addresses describe infrastructure objects, while Makefile recipes are executed by a shell. A string that is harmless in the former context can be dangerous in the latter if special characters are not handled correctly.
AWS has issued a corrected CLI release. Its guidance also calls for users to ensure that Terraform configurations and plan files consumed by the affected hook come from trusted sources, and to review third-party modules or shared repositories supplying the build. Those controls address the provenance of inputs, while the software update corrects the defective handling.
Teams using SAM CLI without the Terraform hook do not face this particular path merely by having SAM CLI installed. Conversely, users of the affected hook should assess whether outside contributors, build dependencies or automated changes could have altered configuration files before the update. The public advisory does not report confirmed exploitation or a list of affected customers.
Because CI/CD systems can be highly automated, the fix may need to be deployed in developer workstations, container images and hosted build runners. A locally updated CLI does not necessarily change the binary pinned in an older build image or reusable pipeline action.
The risk may be carried forward through build templates and reusable containers even after developers update their laptops. A central pipeline that restores an older image before each build could continue to invoke the vulnerable hook, and an unreviewed infrastructure module could reintroduce attacker-influenced metadata. Confirming the fix therefore involves the version actually executed in the build job and the provenance of the Terraform files it consumes, not only the repository’s declared tooling policy.
The vulnerability was reported through coordinated disclosure, and AWS credits security researcher Shubham Raj of Cipher by Causal Security. The corrected 1.166.2 release applies to the Terraform build hook, while other SAM CLI functions are not implicated by this particular disclosure.
