Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`

Asset: aws-cdk-lib (npm package), source: https://github.com/aws/aws-cdk Severity: High CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection')

Summary

The NodejsFunction construct in aws-cdk-lib/aws-lambda-nodejs constructs a shell command string from several user-controlled bundling properties (externalModules, define, loader, inject, esbuildArgs) without sanitizing or escaping shell metacharacters. This command string is then executed via spawnSync('cmd', ['/c', command]) on Windows or spawnSync('bash', ['-c', command]) on Linux/macOS.