AWS Amplify Codegen UI - Unsanitized Code Injection in buildConditionalExpression (CVE-2025-4318 Sibling)
Summary
The buildConditionalExpression function in react-component-render-helper.ts passes user-controlled property and field values from ConditionalStudioComponentProperty.condition directly to factory.createIdentifier() without calling escapePropertyValue() or any sanitization. This is the same vulnerability class as CVE-2025-4318 (GHSA-hf3j-86p7-mfw8) but in a different code path that was missed by all three fix commits.
Affected Code
File: packages/codegen-ui-react/lib/react-component-render-helper.ts, lines 615-647
AWS Amplify Codegen UI - Unsanitized Code Injection in buildConditionalExpression (CVE-2025-4318 Sibling)
Summary
The
buildConditionalExpressionfunction inreact-component-render-helper.tspasses user-controlledpropertyandfieldvalues fromConditionalStudioComponentProperty.conditiondirectly tofactory.createIdentifier()without callingescapePropertyValue()or any sanitization. This is the same vulnerability class as CVE-2025-4318 (GHSA-hf3j-86p7-mfw8) but in a different code path that was missed by all three fix commits.Affected Code
File:
packages/codegen-ui-react/lib/react-component-render-helper.ts, lines 615-647