Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in e…

A critical vulnerability (CVE-2026-18245) exists in Amazon @aws-amplify/codegen-ui-react before version 2.20.6, allowing improper control of code generation. A remote authenticated attacker could execute arbitrary code across multiple environments including end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts. The attack vector involves crafting malicious Studio component or theme schema values. This vulnerability exists due to insufficient input validation introduced as a fix for CVE-2025-4318, effectively making it a bypass of the previous remediation. Users are strongly advised to upgrade to version 2.20.6 to address this issue.