GHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file write
Summary
Language Servers for AWS (developer tools used in IDEs like VS Code and JetBrains) has a vulnerability where it fails to validate symlinks (shortcuts that point to files elsewhere on the system). An attacker could create a malicious workspace containing a symlink that points outside the workspace boundary, causing the tool to write files to unauthorized locations without asking the user first.
Solution / Mitigation
Upgrade to AWS Language Servers version 1.69.0 or later. The source states: 'This issue has been addressed in AWS Language Servers version 1.69.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.'
Vulnerability Details
EPSS: 0.2%
Yes
September 24, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-6v3r-4p5c-mrp5
First tracked: September 24, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 92%