CodeBuild Flaw Put AWS Console Supply Chain At Risk

Wiz Research discovered a critical CodeBuild misconfiguration (an unanchored ACTOR_ID regex) that could let unauthenticated pull requests run privileged builds, exposing GitHub credentials and allowing attackers to inject malicious code into core AWS repositories — notably the AWS SDK for JavaScript used broadly across cloud environments. Wiz demonstrated admin takeover of aws/aws-sdk-js-v3; AWS remediated the flaw within 48 hours, revoked exposed credentials, added build protections, and reported no evidence of active exploitation.