{"items":[{"id":"NVI-00012940","kind":"vulnerability","title":"Language Servers for AWS Vulnerable to Arbitrary Code Execution","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-xhcr-j4j9-3gh7","CVE-2026-12957"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0101045c00ce6ade4b917aae755ac721"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"7.8 HIGH (3.1)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"},{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"8.5 HIGH (4.0)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"},{"kind":"EPSS","as_of":"2026-11-06T12:00:23.000Z","value":"0.234%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.14323. Missing scores are unknown.","source_id":"sr-0101045c00ce6ade4b917aae755ac721"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-154e273e4de9d10a0fde0fbfc52f7e9c","url":"https://github.com/advisories/GHSA-xhcr-j4j9-3gh7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xhcr-j4j9-3gh7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-54a42b450480d11e1f970c21700784d5","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12957","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-12957","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:32.503Z"},{"id":"sr-0101045c00ce6ade4b917aae755ac721","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-12957","publisher":"FIRST EPSS","observed_at":"2026-11-06T20:58:43.524Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-154e273e4de9d10a0fde0fbfc52f7e9c"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"### Summary\nLanguage Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and\nVisual Studio).\n\nImproper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically\nexecuted.\n\n### Impact\n\nWhen a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the\nuser's host.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files.\n\n\nImpacted versions: Language Servers for AWS version <1.65.0.\n\n### Patches\nThis issue has been addressed in Language Servers for AWS version 1.65.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n","public_affected_ranges":["< 0.0.113"]}],"null_published_at":"2026-11-07T22:29:26.078Z","source_updated_at":"2026-09-24T19:13:54.000Z","source_disclosed_at":"2026-09-24T19:13:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00012940","kind":"vulnerability","title":"Language Servers for AWS Vulnerable to Arbitrary Code Execution","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-xhcr-j4j9-3gh7","CVE-2026-12957"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-051ff2200672fbba3c6bf8e0b3eaa617"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"7.8 HIGH (3.1)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"},{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"8.5 HIGH (4.0)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"},{"kind":"EPSS","as_of":"2026-11-05T12:03:04.000Z","value":"0.234%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.14346. Missing scores are unknown.","source_id":"sr-051ff2200672fbba3c6bf8e0b3eaa617"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-154e273e4de9d10a0fde0fbfc52f7e9c","url":"https://github.com/advisories/GHSA-xhcr-j4j9-3gh7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xhcr-j4j9-3gh7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-54a42b450480d11e1f970c21700784d5","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12957","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-12957","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:32.503Z"},{"id":"sr-051ff2200672fbba3c6bf8e0b3eaa617","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-12957","publisher":"FIRST EPSS","observed_at":"2026-11-06T00:24:57.643Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-154e273e4de9d10a0fde0fbfc52f7e9c"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"### Summary\nLanguage Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and\nVisual Studio).\n\nImproper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically\nexecuted.\n\n### Impact\n\nWhen a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the\nuser's host.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files.\n\n\nImpacted versions: Language Servers for AWS version <1.65.0.\n\n### Patches\nThis issue has been addressed in Language Servers for AWS version 1.65.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n","public_affected_ranges":["< 0.0.113"]}],"null_published_at":"2026-11-07T07:07:46.830Z","source_updated_at":"2026-09-24T19:13:54.000Z","source_disclosed_at":"2026-09-24T19:13:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00012940","kind":"vulnerability","title":"Language Servers for AWS Vulnerable to Arbitrary Code Execution","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-xhcr-j4j9-3gh7","CVE-2026-12957"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-54a42b450480d11e1f970c21700784d5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"7.8 HIGH (3.1)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"},{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"8.5 HIGH (4.0)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-54a42b450480d11e1f970c21700784d5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-154e273e4de9d10a0fde0fbfc52f7e9c","url":"https://github.com/advisories/GHSA-xhcr-j4j9-3gh7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xhcr-j4j9-3gh7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-54a42b450480d11e1f970c21700784d5","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12957","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-12957","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:32.503Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-154e273e4de9d10a0fde0fbfc52f7e9c"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"### Summary\nLanguage Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and\nVisual Studio).\n\nImproper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically\nexecuted.\n\n### Impact\n\nWhen a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the\nuser's host.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files.\n\n\nImpacted versions: Language Servers for AWS version <1.65.0.\n\n### Patches\nThis issue has been addressed in Language Servers for AWS version 1.65.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n","public_affected_ranges":["< 0.0.113"]}],"null_published_at":"2026-11-05T19:10:23.271Z","source_updated_at":"2026-09-24T19:13:54.000Z","source_disclosed_at":"2026-09-24T19:13:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00012940","kind":"vulnerability","title":"Language Servers for AWS Vulnerable to Arbitrary Code Execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xhcr-j4j9-3gh7","CVE-2026-12957"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-154e273e4de9d10a0fde0fbfc52f7e9c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-154e273e4de9d10a0fde0fbfc52f7e9c","url":"https://github.com/advisories/GHSA-xhcr-j4j9-3gh7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xhcr-j4j9-3gh7","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-154e273e4de9d10a0fde0fbfc52f7e9c"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"### Summary\nLanguage Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and\nVisual Studio).\n\nImproper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically\nexecuted.\n\n### Impact\n\nWhen a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the\nuser's host.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files.\n\n\nImpacted versions: Language Servers for AWS version <1.65.0.\n\n### Patches\nThis issue has been addressed in Language Servers for AWS version 1.65.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. \n\n","public_affected_ranges":["< 0.0.113"]}],"null_published_at":"2026-11-01T07:29:12.903Z","source_updated_at":"2026-09-24T19:13:54.000Z","source_disclosed_at":"2026-09-24T19:13:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:52.155Z"}],"next_cursor":null,"snapshot_revision":"42594"}