CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systems
CVE-2026-109518
Summary
Bulletin ID: 2026-173-AWS
Publication Date: 11/06/2026 09:00 AM PST
Description:
We identified CVE-2026-122193, an OS command injection issue in an example provided in the set-up documentation. The example included a script that creates AWS Systems Manager (SSM) documents (Rex-RO and Rex-RW) for running scripts on managed instances.
Due to how the example script handled input parameters, a user with permissions to invoke the SSM document could supply crafted input that would run unintended operating system commands on the managed instance, outside of the REX sandbox. The scriptArgs parameter is affected by the same class of issue.
Impacted versions:
This is not an issue in a shipped REX artifact version.
Refer to the article below for the most up-to-date and complete information.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.