Arbitrary Code Execution in Language Servers for AWS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-12957 · Microsoft / collected KEV context

EUVD-2026-38488

GHSA-xhcr-j4j9-3gh7

cve-program · CVE-2026-12957

• https://aws.amazon.com/security/security-bulletins/2026-047-aws/
• https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7

euvd · EUVD-2026-38488

• https://aws.amazon.com/security/security-bulletins/2026-047-aws/
• https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7

nvd · CVE-2026-12957

• https://aws.amazon.com/security/security-bulletins/2026-047-aws/
• https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7

osv · GHSA-xhcr-j4j9-3gh7

• https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-12957
• https://github.com/Amazon-Q-Developer/language-servers/pull/2708
• https://github.com/Amazon-Q-Developer/language-servers/pull/2711
• https://github.com/Amazon-Q-Developer/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458
• https://github.com/Amazon-Q-Developer/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410
• https://aws.amazon.com/security/security-bulletins/2026-047-aws
• https://github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.65.0
• https://github.com/aws/language-servers

No related operational record is retained in the current change model.