{"id":"EUVD-2026-38489","enisaUuid":"96923d30-1526-3dd5-9392-720b2774dccb","description":"Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n\n\nTo remediate this issue, users should upgrade to version 1.69.0 or higher.","datePublished":"Jun 23, 2026, 4:03:01 PM","dateUpdated":"Jun 23, 2026, 5:56:13 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-047-aws/\nhttps://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5\n","aliases":"CVE-2026-12958\nGHSA-6v3r-4p5c-mrp5\n","assigner":"AMZN","epss":0.19,"enisaIdProduct":[{"id":"e31a6636-fa4b-39f1-991c-796489bfd5af","product":{"name":"Language Servers for AWS","vendor":{"name":"Amazon Web Services"}},"product_version":"0 \u003c1.69.0"}],"enisaIdVendor":[{"id":"99459207-960d-3132-a0c2-a6a39f9f33c9","vendor":{"name":"Amazon Web Services"}}],"enisaIdVulnerability":[{"id":"1225639a-2efd-374a-89c1-d80632fabbbe","vulnerability":{"id":"CVE-2026-12958","description":"Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n\n\nTo remediate this issue, users should upgrade to version 1.69.0 or higher.","datePublished":"Jun 23, 2026, 4:03:01 PM","dateUpdated":"Jun 23, 2026, 5:56:13 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://aws.amazon.com/security/security-bulletins/2026-047-aws/\nhttps://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5\n","enisa_id":"EUVD-2026-38489\n","assigner":"AMZN","epss":0.19,"dataProcessed":"Oct 29, 2026, 7:19:11 AM","vulnerabilityProduct":[{"id":"de2c8982-d495-3f87-ac32-243baa8fde3a","product":{"name":"Language Servers for AWS","vendor":{"name":"Amazon Web Services"}},"product_version":"0 \u003c1.69.0"}],"vulnerabilityVendor":[{"id":"5cde0689-81a9-39ae-9f41-f3ad0445380b","vendor":{"name":"Amazon Web Services"}}]}},{"id":"1cc1c416-6599-3607-a477-a1897e48f438","vulnerability":{"id":"GHSA-6v3r-4p5c-mrp5","description":"Language Servers for AWS vulnerable to arbitrary file write","datePublished":"Sep 24, 2026, 7:15:39 PM","dateUpdated":"Sep 24, 2026, 7:15:40 PM","baseScore":0.0,"references":"https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12958\nhttps://github.com/Amazon-Q-Developer/language-servers/pull/2742\nhttps://github.com/Amazon-Q-Developer/language-servers/commit/6c279b083cc192aa5df1f38c2c185576fd5234f5\nhttps://aws.amazon.com/security/security-bulletins/2026-047-aws\nhttps://github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.69.0\nhttps://github.com/Amazon-Q-Developer/language-servers/releases/tag/lsp-codewhisperer/v0.0.117\nhttps://github.com/aws/language-servers\n","enisa_id":"EUVD-2026-38489\n","aliases":"GHSA-6v3r-4p5c-mrp5\nCVE-2026-12958\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}