CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Summary

CVE-2026-120497 is a stored cross-site scripting flaw in the HTML report generator of the aidlc-traceability CLI, an open source tool formerly published in the awslabs/aidlc-workflows repository. An actor who can modify a project's AI-DLC artifact files can embed script through crafted artifact titles or descriptions, which then runs in the browser of a user who opens a generated HTML traceability report. Affected versions are >=0.1.0 and earlier than commit 96cf0ea.

Mitigation

Fixed in commit 96cf0ea (fixed 2026-07-03).

Related items

• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database
• MediumCVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP ServerSame vendor · AWS Security Bulletins