AWS SAM CLI CVE-2026-115414: Arbitrary Command Execution via Terraform Hook

TL;DR

---

On October 22, 2026 (PT), AWS disclosed CVE-2026-115414, an OS command injection vulnerability in the Terraform hook of the AWS Serverless Application Model (SAM) CLI (GitHub Advisory GHSA-44mq-wjrh-vpj6).

AWS SAM CLI builds and deploys serverless applications like AWS Lambda. While SAM normally processes CloudFormation-based templates, passing --hook-name terraform allows it to handle Terraform projects.
The vulnerability stemmed from the Makefile generation step in the Terraform hook, which placed Terraform resource addresses into shell command lines with insufficient sanitization.
Patched release 1.166.2 was published on September 11, 2026, about six weeks before the CVE and advisory were publicly released.

Affected Versions and Conditions

Item	Details
Package	AWS SAM CLI (PyPI: aws-sam-cli)
Affected Versions	1.63.0 up to, but not including, 1.166.2 (1.63.0–1.166.1)
Patched Version	1.166.2
Triggering Command	sam build --hook-name terraform
CVSS 3.1	7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS 4.0	8.4 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CWE	CWE-78 (OS Command Injection)
Finder	Shubham Raj at Cipher by Causal Security

The CVSS 4.0 score and CWE identifier appear in the CVE Record published by AWS as the CNA.

Version 1.63.0 introduced Terraform support in SAM CLI.
The first entry in the v1.63.0 release notes is “feat: Terraform support”, published in November 2022.
Every release from the introduction of the Terraform hook through 1.166.1 is affected.

The advisory targets only the Terraform hook implementation. Builds relying solely on standard SAM templates are not affected.
Projects that do not invoke --hook-name terraform remain outside the scope of this issue.

The CVSS assessment classifies the attack vector as local (AV:L) requiring user interaction (UI:R / UI:A).
The scenario assumes an attacker prepares a crafted Terraform configuration or plan file, which a developer or CI pipeline subsequently builds.
CISA’s evaluation in the CVE record notes no active exploitation (Exploitation: none) and confirms the attack cannot be automated broadly (Automatable: no) as of October 23, 2026.

How the Command Injection Occurred

When running sam build --hook-name terraform, SAM CLI executes terraform init and terraform plan, capturing the plan output as JSON.
It then scans for SAM metadata resources (null_resource.sam_metadata_*) in the project.
SAM metadata resources are null_resource declarations used to tell SAM CLI which Lambda function maps to which build directory and source artifact (AWS documentation).

SAM CLI generates a Makefile rule for each SAM metadata resource and invokes make to execute the build.
Each rule executes a single Python command that copies build artifacts.
Through version 1.166.1 (samcli/hook_packages/terraform/hooks/prepare/makefile_generator.py), SAM CLI constructed this command from the following template:

show_command_template = (
    '{python_command_name} "{terraform_built_artifacts_script_path}" '
    '--expression "{jpath_string}" --directory "$(ARTIFACTS_DIR)" --target "{resource_address}"'
)

{resource_address} contains the Terraform address of the SAM metadata resource (such as null_resource.sam_metadata_fn).
While SAM CLI wrapped this value in double quotes, its only preprocessing was escaping existing double quotes to \".
Inside double quotes, shells still evaluate backticks and $(...) as command substitutions.
If the address contains strings like $(whoami) or command substitutions wrapped in backticks, the shell executes them as distinct commands rather than treating them as literal text.

When Terraform creates resources dynamically with for_each, each resource address appends the map key (formatted as null_resource.sam_metadata_fn["key"]).
The commit message lists two injection vectors: crafted for_each keys and modified plan files (commit 5b20d0e).
Command substitutions placed into a key expand directly into the generated Makefile rule and run in the shell during the build.

graph TD
    A["Terraform config or plan file<br/>(crafted for_each key)"] --> B["sam build --hook-name terraform"]
    B --> C["Parse SAM metadata resources<br/>from terraform plan JSON"]
    C --> D["Interpolate resource address<br/>into Makefile rule"]
    D --> E["make invokes shell to run command"]
    E --> F["Arbitrary command runs under<br/>build user privileges"]

Why shlex.quote Broke on Windows

Commit 5b20d0e notes that the team initially attempted to sanitize inputs using Python’s standard shlex.quote().

However, the Terraform hook also runs on Windows. When GNU make cannot locate sh.exe, it falls back to cmd.exe to execute Makefile commands.
Since cmd.exe does not recognize single quotes as command line quotation marks, wrapping arguments with shlex.quote() caused all builds on Windows to fail immediately.

With POSIX shell quoting unable to provide cross-platform compatibility, the fix changed the design entirely.
Instead of interpolating addresses into the command string, SAM CLI now writes arguments to a small JSON file (.args.json) and passes only that file’s path to the Makefile command.
Because external inputs no longer touch the shell or make command line directly, argument escaping became unnecessary.

Impact on Build Environments and CI Secrets

The advisory identifies four operational characteristics of the injected commands:

Characteristic	Operational Detail
Runs during build	Triggers immediately when running sam build, before any deployment
Requires no AWS credentials	Succeeds even if the attacker has no access to the AWS account
Runs even on build failure	Injected commands execute prior to build errors terminating the job
Inherits build user permissions	Executes under the developer’s account locally, or the runner user in CI

The highest practical risk occurs in automated CI environments building third-party Terraform code.
If a CI workflow automatically runs tests or builds on pull requests from forks, environment variables configured on the runner (such as AWS deployment credentials or GitHub tokens) can be exfiltrated.
Furthermore, if an injected command alters compiled artifacts in the output directory, a subsequent sam deploy step will deploy the modified code directly to Lambda.

Building personal Terraform configurations on a local machine without untrusted dependencies carries low risk, as untrusted input does not enter the pipeline.
The advisory recommends reviewing third-party Terraform modules and shared repositories that supply inputs to builds.

Timeline and Update Steps

Date (US Time)	Event
November 2022	v1.63.0 adds Terraform support
September 11, 2026	v1.166.2 released (Makefile generation fix)
October 22, 2026	CVE-2026-115414, GHSA-44mq-wjrh-vpj6, and AWS Bulletin 2026-145-AWS published
October 22, 2026	v1.170.0 released (latest version as of October 26, 2026)

Any installation updated on or after September 11, 2026 already includes the fix.
Verify the installed version by running:

sam --version

If the output indicates SAM CLI, version 1.166.2 or later, the patch is in place.
To upgrade from an earlier release:

Install Method	Upgrade Command
pip	pip install --upgrade aws-sam-cli
Homebrew	brew upgrade aws-sam-cli
Official installer (macOS pkg, Windows MSI, Linux zip)	Download and install the latest package from GitHub Releases

For CI pipelines using pinned package versions such as aws-sam-cli==1.166.1, update the version constraint in the workflow or Dockerfile.
The release notes for v1.166.2 did not mention a security vulnerability, and described the patch simply as “fix(terraform-hook): improve Makefile generation (#9271)”.