# AWS Trusted Remote Execution (REX) setup-guide example SSM documents allow OS command injection (CVE-2026-122193) · pwn.watch > On Nov 6 2026 AWS published Important bulletin 2026-173-AWS for CVE-2026-122193 (GHSA-95g5-m242-wvhr): an OS command injection issue in an example from the Trusted Remote Execution (REX) set-up documentation. The example script creates AWS Systems Manager documents Rex-RO and Rex-RW for running scripts on managed instances; due to how that example handled input parameters (including scriptArgs), a user permitted to invoke the SSM document could supply crafted input that runs unintended OS commands on the managed instance outside the REX sandbox. This is not a flaw in a shipped REX artifact — only operators who created those SSM documents by following the guide are affected. AWS removed the example from the guide. Mitigation: delete any Rex-RO / Rex-RW SSM documents created from the example in each account and Region where it was run. No workaround other than deleting the documents. Page: https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193 · generated 2026-11-07T20:22:27.676Z ## Status - Severity: high · status: live · patch: patched - Product: AWS Trusted Remote Execution (REX) set-up guide example SSM documents (Rex-RO / Rex-RW) - Started: 2026-11-06 - CVEs: CVE-2026-122193 - Affected: Operators who created Rex-RO / Rex-RW SSM documents from the REX set-up guide example (before the guide removed it) - Fixed in: Example removed from REX set-up guide; delete any created Rex-RO / Rex-RW SSM documents ## Follow this incident - RSS (one item per update): https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193/feed.xml - JSON Feed: https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193.json - This file: https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193/llms.txt ## Updates (newest first) - 2026-11-06: AWS publishes Important bulletin 2026-173-AWS for CVE-2026-122193: OS command injection in REX set-up guide example SSM documents Rex-RO/Rex-RW; example removed from guide; delete created documents. (https://aws.amazon.com/security/security-bulletins/2026-173-aws/) ## Fix brief # Security brief: AWS Trusted Remote Execution (REX) setup-guide example SSM documents allow OS command injection (CVE-2026-122193) Source: https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193 · status: live · severity: high · updated Nov 7, 2026, 02:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On Nov 6 2026 AWS published Important bulletin 2026-173-AWS for CVE-2026-122193 (GHSA-95g5-m242-wvhr): an OS command injection issue in an example from the Trusted Remote Execution (REX) set-up documentation. The example script creates AWS Systems Manager documents Rex-RO and Rex-RW for running scripts on managed instances; due to how that example handled input parameters (including scriptArgs), a user permitted to invoke the SSM document could supply crafted input that runs unintended OS commands on the managed instance outside the REX sandbox. This is not a flaw in a shipped REX artifact — only operators who created those SSM documents by following the guide are affected. AWS removed the example from the guide. Mitigation: delete any Rex-RO / Rex-RW SSM documents created from the example in each account and Region where it was run. No workaround other than deleting the documents. Severity detail: AWS Important bulletin; authenticated invokers of example Rex-RO/Rex-RW SSM docs can run OS commands outside the REX sandbox; not in shipped REX artifact - Product: AWS Trusted Remote Execution (REX) set-up guide example SSM documents (Rex-RO / Rex-RW) - CVE / advisory ids: CVE-2026-122193 ## Affected versions - Operators who created Rex-RO / Rex-RW SSM documents from the REX set-up guide example (before the guide removed it) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Example removed from REX set-up guide; delete any created Rex-RO / Rex-RW SSM documents After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes If you followed the REX set-up guide and created Rex-RO or Rex-RW SSM documents, delete them in every AWS account and Region where you ran the example (SSM delete-document). The example has been removed from the guide. Shipped REX artifacts are not affected. ## Latest updates - Nov 6, 2026: AWS publishes Important bulletin 2026-173-AWS for CVE-2026-122193: OS command injection in REX set-up guide example SSM documents Rex-RO/Rex-RW; example removed from guide; delete created documents. ## Advisories - [CVE-2026-122193 - Issue with Trusted Remote Execution Setup Guide - OS command injection in the example SSM documents in Trusted Remote Execution (REX)](https://aws.amazon.com/security/security-bulletins/2026-173-aws/) (AWS) - [GHSA-95g5-m242-wvhr](https://github.com/advisories/GHSA-95g5-m242-wvhr) (GitHub Advisory) ## Caveats Not a vulnerability in a shipped REX package version. Do not cite cve.now. --- Machine-readable: https://pwn.watch/i/aws-rex-example-ssm-command-injection-cve-2026-122193.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.