Language Servers for AWS Vulnerable to Arbitrary Code Execution
Summary
Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio).
Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed.
Impact
When a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the user's host.
This issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files.
Impacted versions: Language Servers for AWS version <1.65.0.
Patches
This issue has been addressed in Language Servers for AWS version 1.65.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
No workarounds are available.
References
If you have any questions or comments about this advisory, AWS Security asks that you contact them via their vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
AWS Security would like to thank Wiz and Maor Dokhanian for collaborating on this issue through the coordinated vulnerability disclosure process.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Paczka npm | @aws/lsp-codewhisperer | < 0.0.113 | 0.0.113 |
Odnośniki
- https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7
- https://nvd.nist.gov/vuln/detail/CVE-2026-12957
- https://github.com/Amazon-Q-Developer/language-servers/pull/2708
- https://github.com/Amazon-Q-Developer/language-servers/pull/2711
- https://github.com/Amazon-Q-Developer/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458
- https://github.com/Amazon-Q-Developer/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410
- https://aws.amazon.com/security/security-bulletins/2026-047-aws
- https://github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.65.0
- https://github.com/aws/language-servers
- Wektor CVSS
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Słabość (CWE)
CWE-732- Platforma
- npm
- Paczka
@aws/lsp-codewhisperer- Ujawniono
- 24.09.2026
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-xhcr-j4j9-3gh7 - CC BY 4.0
Historia podatności: @aws/lsp-codewhisperer
Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 2
- Pierwsza → ostatnia
- 09.2026 09.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 2
Ujawnienia w latach
- 2026: 2
-
Language Servers for AWS Vulnerable to Arbitrary Code Execution ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.