AWS has identified a critical vulnerability, CVE-2026-81838, in their diagram-as-code CLI tool, awsdac. This tool generates AWS architecture diagrams from YAML definitions. The vulnerability is a Zip Slip or path traversal flaw affecting the extraction of zip archives. A maliciously crafted zip file can cause awsdac to write files to arbitrary locations on the system. This can potentially lead to arbitrary code execution on the machine running awsdac. The vulnerability is exploitable when processing definition files from untrusted sources. This includes running awsdac without proper trust restrictions or loading local files that bypass URL allowlists. CI/CD pipelines that handle untrusted definition files are particularly at risk. The issue is limited to the local machine where awsdac operates. It does not impact any AWS services, accounts, or customer data. Versions 0.10 through 0.23 of awsdac are affected by this vulnerability.