{"data":{"id":"ef704bee-7e72-4186-9574-f0d308e1503b","title":"GHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file write","summary":"Missing symlink validation in Language Servers for AWS (aws/language-servers) may allow an arbitrary file write outside the workspace trust boundary. Impacted versions are Language Servers for AWS <1.69.0. The agent may follow a symlink inside a trusted workspace to an external location and write there without prompting the user for approval.","solution":"Fixed in AWS Language Servers version 1.69.0. Upgrade to the latest version and ensure any forked or derivative code is patched with the new fixes. No workarounds are available.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-6v3r-4p5c-mrp5","publishedAt":"2026-09-24T19:15:39.000Z","cveId":"CVE-2026-12958","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@aws/lsp-codewhisperer@< 0.0.117 (fixed: 0.0.117)"],"affectedPackageNames":["@aws/lsp-codewhisperer"],"affectedPackageRefs":["npm:@aws/lsp-codewhisperer"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["Language Servers for AWS","Amazon Q Developer"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00191,"epssCheckedAt":"2026-11-10T06:09:42.499Z","kevDateAdded":null,"advisoryAliases":["GHSA-6v3r-4p5c-mrp5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-24T19:15:39.000Z","fixReleasedAt":"2026-05-26T20:39:59.280Z","daysToFix":-121,"fixCheckedAt":"2026-10-29T21:30:14.656Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@aws/lsp-codewhisperer","fixedVersion":"0.0.117","matchedVersion":"0.0.117","fixReleasedAt":"2026-05-26T20:39:59.280Z","daysToFix":-121,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:14.504Z"}]}}