Intelligence
Join the waitlist
AEW-026

A value accepted as data during generation executes under a later deployer's own authority

A code generator turns a caller supplied value, accepted purely as data, into source text for a separate, persisted artifact. Nothing at generation time executes that artifact. What it does only takes effect later, when a different actor compiles and deploys it, and whatever the data became runs under that later deployer's own host and cloud authority, not any authority the data's own author held or needed.

Status: publishedExecution AuthorityEnvironment BoundariesSequence Integrity

Description

This weakness names a data to code transition whose consequence is deferred across a persistence gap, rather than one resolved immediately inside a single process or a single argument list. A tool's stored field later evaluated as a program (AEW-023) and a declared capability failing to survive an executor's own argument grammar (AEW-025) both describe a value crossing from data into control syntax, and both describe that crossing resolving at once, inside one invocation, evaluated or parsed by the same system that received the value. Here the crossing happens at generation time, when a template renders a caller supplied value into a separate artifact's own source text, and the consequence of that crossing does not exist yet: the artifact is an ordinary, persisted file, inert until something later compiles or deploys it. That later action can run on a different host, under a different identity, at a materially later time, and often by a different principal than the one who authored the data or invoked generation, and none of that later principal's own authority to deploy the intended artifact extends to authority over content injected into it by a value nobody separately evaluated as executable. This differs from an approval failing to bind to what executes (AEW-005), which concerns a single review and execution cycle where an approved object and an executed one diverge inside one workflow: here there is frequently no approval step named for either the data model or the generated artifact at all, and the gap is not a broken binding between a review and its subject but the absence of any re evaluation when a value's own semantic class changes from data to code partway through a pipeline that spans two separate authority moments.

The authority gap

The authority presented is whatever the later deployer holds to build or deploy the artifact the generator was meant to produce. The authority required covers whatever the artifact actually contains once a caller supplied value has been rendered into its source text, and nothing in the pipeline re evaluates that gap once generation completes, so the deployer's own authority is silently treated as covering content nobody separately authorized.

Failure conditions

  • A code generator renders a caller supplied value, accepted and typed purely as data, into the source text of a separate artifact, whether as a string literal, an identifier or another syntactic position of the artifact's own language.
  • The generator's own process ends once the artifact is produced, so the value's consequence, if any, does not exist at generation time and depends entirely on a later, separate action against the persisted artifact.
  • The later action that gives the artifact effect, typically a build, a compile or a deployment step, can be performed by a different principal, on a different host, holding authority over the artifact's intended function but nothing that separately evaluates content a caller supplied value injected into it.

Consequences shown by the evidence

  • A caller who holds no deployment authority, and needs none, places a value into a data file that later executes with the full host and cloud authority of whoever deploys the artifact the value was rendered into, at a time and on a system the caller may never interact with directly.
  • A generated artifact is treated as trustworthy because the tool that produced it is trusted, even though the specific content it carries was never independently evaluated against the authority of whoever will later give that content effect.

Detection signals

  • A code generator's own template interpolates a caller supplied value into a target language's string literal or identifier position with no escaping or character set validation applied at that exact interpolation site.
  • A fix for the class changes both an identifier bound validation step and a string literal bound escaping step together, evidence that a single, uniform treatment of every interpolated value was previously insufficient for at least one of the two positions.
  • The interval between an artifact's generation and its deployment is unbounded and untracked, so a persisted artifact can outlive a fix to the generator that produced it, or reach deployment under a review that only ever saw the source data, never the generated artifact itself.

Known examples

  • Amazon's awslabs.dynamodb-mcp-server CDK generator rendered table, index and attribute names from a caller supplied dynamodb_data_model.json file into a generated AWS CDK application's stack.ts.j2 template. This entry independently cloned the affected repository and confirmed the mechanism directly: table and index names reached TypeScript identifier positions, built by the generator's own to_camel_case and to_pascal_case filters, with no character set or length validation, a position where escaping cannot apply at all, while every attribute, key and time to live name reached bare single quoted TypeScript string literal positions with no escaping whatsoever. A crafted name could corrupt the generated identifier or break out of the literal, and the resulting TypeScript source took effect only later, when a person or a pipeline compiled and deployed the generated CDK application, executing with that later deployer's own host and cloud authority rather than any authority the data model's own author held. Formally assigned CVE-2026-85654 on 4 September 2026. This entry independently traced the vulnerable template to its own introduction, confirmed the fix, commit 46ca139f, validates table and index names against DynamoDB's own permitted character set before they reach an identifier position and wraps every attribute level interpolation in Jinja's tojson filter, and independently confirmed that fix is a direct ancestor of the automated release commit that carries the affected package from version 2.1.5 to version 2.1.6, with the current default branch, version 2.1.7, still carrying it unchanged.

Protocol evidence

Published authority architectures whose artifacts bear on the requirement this weakness names: which satisfy it, which expose a way past it, and which leave it unanswered.

  • Supports requirement

    ChainIT Authority Protocol and Agent Subject Profile for pre execution authority validation

    ChainIT

    Requirement A canonical transaction digest is described binding payer, payee, destination, amount, currency or asset and payment rail to approval and execution

    ChainIT's canonical transaction digest binds an approval to the exact fields of the transaction it covers, a corrective this weakness names for a different artifact class: a generated CDK application whose own content a data model name can silently change between the moment it is produced and the moment a deployer gives it effect. This entry's own reading of the affected generator shows no equivalent binding existed, at any point, between the data model an author supplied and the generated stack.ts a deployer later compiled and deployed.

    View protocol evidence

  • Supports requirement

    EP Authorization Receipts (EMILIA Protocol)

    Iman Schrock, EMILIA Protocol, Inc., individual submission to the IETF

    Requirement Implementations MUST reject an approval request whose action hash does not match a locally recomputed hash of the presented Action Object

    EMILIA's requirement that an approval be rejected unless the action hash matches a locally recomputed hash of the exact action object is the binding this weakness shows missing across a longer, deferred gap: whoever later runs cdk deploy authorizes the deployment of the CDK application the generator was meant to produce, not a specific, hashed stack.ts whose content that principal separately reviewed. Amazon's own CDK generator, before its fix, is concrete evidence for the consequence of that gap, a persisted generated artifact whose exact content a crafted data model name changed without anyone re-hashing or re-reviewing it before deployment gave it effect.

    View protocol evidence