CVE-2026-89065 AWS CVE debrief

Who should care

Developers and administrators using projen versions before 0.101.37 should assess exposure and upgrade to the latest version. This involves reviewing project configurations for secure deployment and verifying that the projen runtime is configured to apply the corrected containment check. Security teams should prioritize upgrading to version 0.101.37 and review compensating controls for exposed systems.

Why it matters

CVE-2026-89065 is a medium-severity vulnerability in projen that could allow context-dependent attackers to delete files and directories outside the project directory. Defenders should prioritize upgrading to version 0.101.37 and review project configurations for secure deployment.

• Potential for unauthorized file deletion
• Need for version upgrade verification
• Possible impact on project directory security
• Requirement for secure configuration review

Technical summary

A relative path traversal vulnerability in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen. This occurs via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. The corrected containment check in version 0.101.37 prevents such unauthorized file deletion by ensuring that file operations are confined to the project directory.

Defensive priority

Medium priority for upgrading to version 0.101.37

Recommended defensive actions

• Upgrade to projen version 0.101.37
• Review project directories for potential vulnerabilities
• Verify system configurations for secure deployment
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and systems requires verification. The vulnerability is in the generated file manifest cleanup component of projen. Affected users should verify their project configurations and ensure they are running version 0.101.37 or later. Evidence of exposure includes project directories with writable permissions by the environment running projen. Defenders should review project directories for potential vulnerabilities and verify system to at

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.