AWS warns of CVE-2026-122193, a command injection flaw in REX setup guide examples
- Severity
- Medium
- Highest CVSS
- 9.3
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-122193 is an OS command injection in the example script from the Trusted Remote Execution (REX) setup guide, which creates the AWS Systems Manager (SSM) documents Rex-RO and Rex-RW. A user with permission to invoke these SSM documents can supply crafted input to run arbitrary OS commands on managed instances outside the REX sandbox, and the scriptArgs parameter has the same weakness. AWS states that no shipped REX artifact version is affected, so the exposure is limited to deployments built from the example. Defenders should review any SSM documents created from that example and restrict who can invoke them, and should follow the full AWS bulletin for updates.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether you created the Rex-RO or Rex-RW SSM documents using the example script from the REX setup guide.
- Review who holds permission to invoke those SSM documents and remove any access that is not needed.
- Read the full AWS bulletin 2026-173-AWS for the latest and most complete information.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Who and what is in it
Companies