CRITICAL: @aws-amplify/codegen-ui-react — AWS Amplify Studio UI Component Properties Has an Input Validation Issue
Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS…
Source @aws-amplify/codegen-ui-reactPublished 4d ago · Jul 30, 2026Posted on Bluesky
What we hold
- Package
- @aws-amplify/codegen-ui-react
- Ecosystem
- npm
- Severity
- CRITICAL
- ID
- CVE-2025-4318
Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS…
More like this
HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…
HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer
Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…
CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…