npm package report

Is aws-cdk-lib safe?

aws-cdk-lib (npm) has 8 known vulnerabilities, the worst rated HIGH. Upgrade to 2.260.0 or later to clear all of them. No malicious-package signal is recorded.

// reach

15 direct dependencies

3 carry known advisories, worst HIGH

1 packages depend on it

an advisory here reaches each of them

cdk-tweet-queue

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

7.3

high

CVSS v3.1 base score out of 10

epss

1.2%

medium

chance of exploitation in 30 days, 68th percentile of all CVEs

xyz score

4.0

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-vcrf-j523-4mrf, the advisory selected below

// 8 advisories

GHSA-vcrf-j523-4mrf

HIGHGitHub ratingCVE-2026-13760

AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation.

Full advisory text at GitHub advisory or NVD.

// cvss v3.1 vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

// questions

Is aws-cdk-lib safe to install?

CyberXYZ does not call a package safe in absolute terms. It records 8 known vulnerabilities for aws-cdk-lib (npm), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.

Does aws-cdk-lib have known vulnerabilities?

Yes. CyberXYZ records 8 known vulnerabilities for aws-cdk-lib (npm), the worst rated HIGH. These include GHSA-vcrf-j523-4mrf, GHSA-999r-qq7v-r334, GHSA-qq4x-c6h6-rfxh, GHSA-rx28-r23p-2qc3, GHSA-464c-974j-9xm6.

Which version of aws-cdk-lib should I use?

2.260.0 or later clears every advisory recorded for aws-cdk-lib (npm). Check the release you pick before installing it.

How do I check aws-cdk-lib before installing?

Search aws-cdk-lib in CyberXYZ Check at https://cyberxyz.io/check?q=aws-cdk-lib. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

Checked 2026-11-14 at 11:05 UTC. The most recent advisory here was published 2026-07-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.