AWS VDP · Report #3797662

SQL Injection via Unsanitized Identifiers and String Literals in `@aws-cdk/aws-redshift-alpha` Custom Resource Handlers

Validstatus

highseverity

27upvotes

9 Nov 2026disclosed

Summary

We thank @suul for his report, professional communication, and coordination throughout this report, resulting in CVE-2026-115418.

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original