CVE-2026-12958: Amazon Web Services Language Servers for AWS

Описание

Оригинално описание

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.

Засегнати продукти

• Amazon Web Services Language Servers for AWS: преди 1.69.0

Вид слабост

• CWE-61 Проследяване на символна връзка в UNIX (Symlink Following)

История

Други уязвимости в Amazon Web Services Language Servers for AWS

• 8.5CVE-2026-12957

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-12958
• https://nvd.nist.gov/vuln/detail/CVE-2026-12958
• https://aws.amazon.com/security/security-bulletins/2026-047-aws/
• https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5