After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

The version of AWS SAM CLI installed on the remote host is prior to 1.133.0 and is, therefore, affected by multiple vulnerabilities:

  - When running the AWS SAM CLI build process with Docker and symlinks are included in the build files, the container     environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to     the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a     more permissive location on the container. This issue affects AWS SAM CLI <= v1.132.0 and has been resolved in v1.133.0.
    To retain the previous behavior after upgrading and allow symlinks to resolve on the host machine, please use the     explicit '--mount-symlinks' parameter. (CVE-2025-3047)

  - After completing a build with AWS SAM CLI which include symlinks, the content of those symlinks are copied to the     cache of the local workspace as regular files or directories. As a result, a user who does not have access to those     symlinks outside of the Docker container would now have access via the local workspace. This issue affects AWS SAM CLI     <= v1.133.0 and has been resolved in v1.134.0. After upgrading, users must re-build their applications using the sam     build --use-container to update the symlinks. (CVE-2025-3048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which
    include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular
    files or directories. As a result, a user who does not have access to those symlinks outside of the Docker
    container would now have access via the local workspace. Users should upgrade to version 1.134.0 and
    ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must
    re-build their applications using the sam build --use-container to update the symlinks. (CVE-2025-3048)

ID	Name	Product	Family	Severity
233868	AWS SAM CLI < 1.133.0 multiple vulnerabilities	Nessus	Windows	medium
423592	SCA: security update for aws-sam-cli (GHSA-pp64-wj43-xqcr)	Tenable Cloud Security	SCA Checks	medium
423592	SCA: security update for aws-sam-cli (GHSA-pp64-wj43-xqcr)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-3048

medium

Tenable Plugins

medium

medium

medium