{"items":[{"id":"NVI-00013147","kind":"vulnerability","title":"Language Servers for AWS vulnerable to arbitrary file write","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-6v3r-4p5c-mrp5","CVE-2026-12958"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-37fe3b0c4edecc24c26156b849ec84a6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T19:15:40.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-74cbdea00facd2498cd466d5171edf59"},{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"7.8 HIGH (3.1)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-37fe3b0c4edecc24c26156b849ec84a6"},{"kind":"CVSS","as_of":"2026-10-26T11:10:00.157Z","value":"8.5 HIGH (4.0)","meaning":"ff89ba41-3aa1-4d27-914a-91399e9639e5 severity; no combined Null risk score.","source_id":"sr-37fe3b0c4edecc24c26156b849ec84a6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-74cbdea00facd2498cd466d5171edf59","url":"https://github.com/advisories/GHSA-6v3r-4p5c-mrp5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6v3r-4p5c-mrp5","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-37fe3b0c4edecc24c26156b849ec84a6","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12958","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-12958","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:32.503Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-74cbdea00facd2498cd466d5171edf59"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"## Summary\nLanguage Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse.\n\nMissing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace containing a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n## Impact\n\nIf a user opens a maliciously crafted workspace containing a symlink that resides within the workspace but resolves to a location outside the workspace trust boundary, the agent may follow that symlink and write to the external location without prompting the user for approval. This can result in the modification of files outside the intended workspace boundary.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently writes to a path within that workspace.\n\nImpacted versions: Language Servers for AWS version <1.69.0.\n\n## Patches\nThis issue has been addressed in AWS Lang","public_affected_ranges":["< 0.0.117"]}],"null_published_at":"2026-11-03T10:03:31.394Z","source_updated_at":"2026-09-24T19:15:40.000Z","source_disclosed_at":"2026-09-24T19:15:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00013147","kind":"vulnerability","title":"Language Servers for AWS vulnerable to arbitrary file write","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6v3r-4p5c-mrp5","CVE-2026-12958"],"plain_summary":"GitHub lists this reviewed advisory for @aws/lsp-codewhisperer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-74cbdea00facd2498cd466d5171edf59"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T19:15:40.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-74cbdea00facd2498cd466d5171edf59"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-74cbdea00facd2498cd466d5171edf59","url":"https://github.com/advisories/GHSA-6v3r-4p5c-mrp5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6v3r-4p5c-mrp5","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-74cbdea00facd2498cd466d5171edf59"],"technology":"@aws/lsp-codewhisperer","known_exclusions":[],"conditions_summary":"## Summary\nLanguage Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse.\n\nMissing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace containing a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n## Impact\n\nIf a user opens a maliciously crafted workspace containing a symlink that resides within the workspace but resolves to a location outside the workspace trust boundary, the agent may follow that symlink and write to the external location without prompting the user for approval. This can result in the modification of files outside the intended workspace boundary.\n\nThis issue is triggered when a user opens a workspace, trusts it, and the agent subsequently writes to a path within that workspace.\n\nImpacted versions: Language Servers for AWS version <1.69.0.\n\n## Patches\nThis issue has been addressed in AWS Lang","public_affected_ranges":["< 0.0.117"]}],"null_published_at":"2026-11-01T07:29:12.926Z","source_updated_at":"2026-09-24T19:15:40.000Z","source_disclosed_at":"2026-09-24T19:15:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:52.155Z"}],"next_cursor":null,"snapshot_revision":"42594"}