{"data":{"id":"fa6c56f7-4fc5-46d8-b213-8bd5772eb457","title":"GHSA-xhcr-j4j9-3gh7: Language Servers for AWS Vulnerable to Arbitrary Code Execution","summary":"Language Servers for AWS, the runtime behind Amazon Q Developer's IDE plugins, contains an improper trust boundary enforcement flaw in versions <1.65.0. When a local user opens a maliciously crafted workspace and trusts it, commands defined in project-level configuration files may execute automatically, giving arbitrary code execution on the user's host.","solution":"Fixed in Language Servers for AWS version 1.65.0. Upgrade to the latest version and ensure any forked or derivative code incorporates the fix. No workarounds are available.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-xhcr-j4j9-3gh7","publishedAt":"2026-09-24T19:13:53.000Z","cveId":"CVE-2026-12957","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@aws/lsp-codewhisperer@< 0.0.113 (fixed: 0.0.113)"],"affectedPackageNames":["@aws/lsp-codewhisperer"],"affectedPackageRefs":["npm:@aws/lsp-codewhisperer"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon Q Developer","Language Servers for AWS"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00234,"epssCheckedAt":"2026-11-09T12:10:45.895Z","kevDateAdded":null,"advisoryAliases":["GHSA-xhcr-j4j9-3gh7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-24T19:13:53.000Z","fixReleasedAt":"2026-04-29T21:23:00.387Z","daysToFix":-148,"fixCheckedAt":"2026-10-29T21:30:15.413Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@aws/lsp-codewhisperer","fixedVersion":"0.0.113","matchedVersion":"0.0.113","fixReleasedAt":"2026-04-29T21:23:00.387Z","daysToFix":-148,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:15.259Z"}]}}