{"id":"CVE-2026-12958","summary":"Arbitrary file write in Language Servers for AWS","details":"Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n\n\nTo remediate this issue, users should upgrade to version 1.69.0 or higher.","aliases":["GHSA-6v3r-4p5c-mrp5"],"modified":"2026-07-15T01:49:04.129487191Z","published":"2026-06-23T16:03:01.746Z","database_specific":{"cna_assigner":"AMZN","cwe_ids":["CWE-61"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12958.json"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-047-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12958.json"},{"type":"ADVISORY","url":"https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12958"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws/language-servers","events":[{"introduced":"0"},{"fixed":"7ea760dd4c4e30e12795a83726c38cdce7ea6522"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"1.69.0"}]}}],"versions":["lsp-codewhisperer/v0.0.117","chat-client/v0.1.54","chat-client/v0.1.53","lsp-codewhisperer/v0.0.116","chat-client/v0.1.52","lsp-codewhisperer/v0.0.115","lsp-codewhisperer/v0.0.114","lsp-codewhisperer/v0.0.113","agentic-pre-release-4-29-2026","lsp-codewhisperer/v0.0.112","chat-client/v0.1.51","lsp-codewhisperer/v0.0.111","lsp-codewhisperer/v0.0.110","lsp-codewhisperer/v0.0.109","chat-client/v0.1.50","lsp-codewhisperer/v0.0.108","lsp-codewhisperer/v0.0.107","lsp-yaml/v0.1.26","lsp-partiql/v0.0.23","lsp-json/v0.1.26","lsp-core/v0.0.21","lsp-codewhisperer/v0.0.106","lsp-antlr4/v0.1.25","chat-client/v0.1.49","lsp-codewhisperer/v0.0.105","chat-client/v0.1.48","lsp-codewhisperer/v0.0.104","lsp-codewhisperer/v0.0.103","agentic-1.55.0","lsp-codewhisperer/v0.0.102","chat-client/v0.1.47","lsp-codewhisperer/v0.0.101","lsp-codewhisperer/v0.0.100","lsp-yaml/v0.1.25","lsp-partiql/v0.0.22","lsp-json/v0.1.25","lsp-core/v0.0.20","lsp-codewhisperer/v0.0.99","lsp-antlr4/v0.1.24","chat-client/v0.1.46","lsp-yaml/v0.1.24","lsp-partiql/v0.0.21","lsp-json/v0.1.24","lsp-core/v0.0.19","lsp-codewhisperer/v0.0.98","lsp-antlr4/v0.1.23","chat-client/v0.1.45","lsp-codewhisperer/v0.0.97","chat-client/v0.1.44","lsp-codewhisperer/v0.0.96","lsp-yaml/v0.1.23","lsp-partiql/v0.0.20","lsp-json/v0.1.23","lsp-core/v0.0.18","lsp-codewhisperer/v0.0.95","lsp-antlr4/v0.1.22","chat-client/v0.1.43","lsp-codewhisperer/v0.0.94","lsp-yaml/v0.1.22","lsp-partiql/v0.0.19","lsp-json/v0.1.22","lsp-core/v0.0.17","lsp-codewhisperer/v0.0.92","lsp-antlr4/v0.1.21","chat-client/v0.1.42","lsp-codewhisperer/v0.0.93","lsp-codewhisperer/v0.0.91","lsp-codewhisperer/v0.0.90","lsp-codewhisperer/v0.0.89","chat-client/v0.1.41","lsp-codewhisperer/v0.0.88","lsp-codewhisperer/v0.0.87","chat-client/v0.1.40","lsp-codewhisperer/v0.0.86","lsp-yaml/v0.1.21","lsp-json/v0.1.21","lsp-codewhisperer/v0.0.85","lsp-codewhisperer/v0.0.81","lsp-codewhisperer/v0.0.84","chat-client/v0.1.39","lsp-yaml/v0.1.20","lsp-json/v0.1.20","lsp-core/v0.0.16","lsp-codewhisperer/v0.0.83","lsp-antlr4/v0.1.20","chat-client/v0.1.38","lsp-codewhisperer/v0.0.82","chat-client/v0.1.37","agentic-1.33.0","lsp-codewhisperer/v0.0.80","chat-client/v0.1.36","lsp-codewhisperer/v0.0.79","lsp-yaml/v0.1.19","lsp-partiql/v0.0.18","lsp-json/v0.1.19","lsp-core/v0.0.15","lsp-codewhisperer/v0.0.78","lsp-antlr4/v0.1.19","chat-client/v0.1.35","lsp-codewhisperer/v0.0.77","lsp-codewhisperer/v0.0.76","chat-client/v0.1.34","lsp-codewhisperer/v0.0.75","lsp-yaml/v0.1.18","lsp-partiql/v0.0.17","lsp-json/v0.1.18","lsp-core/v0.0.14","lsp-codewhisperer/v0.0.74","lsp-antlr4/v0.1.18","chat-client/v0.1.33","lsp-codewhisperer/v0.0.73","chat-client/v0.1.32","lsp-codewhisperer/v0.0.72","chat-client/v0.1.31","lsp-yaml/v0.1.17","lsp-partiql/v0.0.16","lsp-json/v0.1.17","lsp-core/v0.0.13","lsp-codewhisperer/v0.0.71","lsp-antlr4/v0.1.17","chat-client/v0.1.30","lsp-codewhisperer/v0.0.70","chat-client/v0.1.29","agentic-1.24.0","lsp-codewhisperer/v0.0.69","chat-client/v0.1.28","lsp-codewhisperer/v0.0.68","chat-client/v0.1.27","lsp-codewhisperer/v0.0.67","chat-client/v0.1.26","lsp-codewhisperer/v0.0.65","chat-client/v0.1.24","lsp-yaml/v0.1.16","lsp-partiql/v0.0.15","lsp-json/v0.1.16","lsp-core/v0.0.12","lsp-codewhisperer/v0.0.66","lsp-antlr4/v0.1.16","chat-client/v0.1.25","lsp-codewhisperer/v0.0.64","lsp-codewhisperer/v0.0.63","chat-client/v0.1.23","lsp-codewhisperer/v0.0.62","lsp-yaml/v0.1.15","lsp-json/v0.1.15","lsp-core/v0.0.11","lsp-codewhisperer/v0.0.61","lsp-antlr4/v0.1.15","chat-client/v0.1.22","lsp-codewhisperer/v0.0.60","chat-client/v0.1.21","lsp-yaml/v0.1.14","lsp-partiql/v0.0.14","lsp-json/v0.1.14","lsp-codewhisperer/v0.0.59","lsp-antlr4/v0.1.14","chat-client/v0.1.20","lsp-codewhisperer/v0.0.56","lsp-yaml/v0.1.13","lsp-json/v0.1.13","lsp-core/v0.0.10","lsp-codewhisperer/v0.0.58","lsp-antlr4/v0.1.13","chat-client/v0.1.19","lsp-codewhisperer/v0.0.57","lsp-codewhisperer/v0.0.55","lsp-codewhisperer/v0.0.49","lsp-codewhisperer/v0.0.54","lsp-codewhisperer/v0.0.53","lsp-codewhisperer/v0.0.52","lsp-codewhisperer/v0.0.51","chat-client/v0.1.18","lsp-yaml/v0.1.12","lsp-partiql/v0.0.13","lsp-json/v0.1.12","lsp-codewhisperer/v0.0.50","lsp-antlr4/v0.1.12","chat-client/v0.1.17","lsp-codewhisperer/v0.0.48","chat-client/v0.1.16","lsp-codewhisperer/v0.0.47","lsp-codewhisperer/v0.0.46","chat-client/v0.1.15","lsp-yaml/v0.1.11","lsp-partiql/v0.0.12","lsp-json/v0.1.11","lsp-codewhisperer/v0.0.45","lsp-antlr4/v0.1.11","chat-client/v0.1.14","lsp-codewhisperer/v0.0.44","lsp-codewhisperer/v0.0.43","lsp-codewhisperer/v0.0.42","chat-client/v0.1.13","lsp-yaml/v0.1.10","lsp-partiql/v0.0.11","lsp-json/v0.1.10","lsp-codewhisperer/v0.0.41","lsp-antlr4/v0.1.10","chat-client/v0.1.12","lsp-yaml/v0.1.9","lsp-partiql/v0.0.10","lsp-json/v0.1.9","lsp-core/v0.0.9","lsp-codewhisperer/v0.0.40","lsp-antlr4/v0.1.9","chat-client/v0.1.11","lsp-codewhisperer/v0.0.39","lsp-yaml/v0.1.8","lsp-partiql/v0.0.9","lsp-json/v0.1.8","lsp-core/v0.0.8","lsp-codewhisperer/v0.0.38","lsp-antlr4/v0.1.8","chat-client/v0.1.10","lsp-yaml/v0.1.7","lsp-json/v0.1.7","lsp-core/v0.0.7","lsp-codewhisperer/v0.0.37","lsp-antlr4/v0.1.7","chat-client/v0.1.9","lsp-yaml/v0.1.6","lsp-json/v0.1.6","lsp-core/v0.0.6","lsp-codewhisperer/v0.0.36","lsp-antlr4/v0.1.6","chat-client/v0.1.8","lsp-yaml/v0.1.5","lsp-json/v0.1.5","lsp-core/v0.0.5","lsp-codewhisperer/v0.0.35","lsp-antlr4/v0.1.5","chat-client/v0.1.7","lsp-codewhisperer/v0.0.34","chat-client/v0.1.6","lsp-yaml/v0.1.4","lsp-partiql/v0.0.8","lsp-json/v0.1.4","lsp-core/v0.0.4","lsp-codewhisperer/v0.0.33","lsp-antlr4/v0.1.4","chat-client/v0.1.5","lsp-codewhisperer/v0.0.32","chat-client/v0.1.4","lsp-yaml/v0.1.3","lsp-partiql/v0.0.7","lsp-json/v0.1.3","lsp-core/v0.0.3","lsp-codewhisperer/v0.0.31","lsp-antlr4/v0.1.3","chat-client/v0.1.3","lsp-codewhisperer/v0.0.30","lsp-yaml/v0.1.2","lsp-partiql/v0.0.6","lsp-json/v0.1.2","lsp-codewhisperer/v0.0.29","lsp-antlr4/v0.1.2","lsp-yaml/v0.1.1","lsp-partiql/v0.0.5","lsp-json/v0.1.1","lsp-core/v0.0.2","lsp-codewhisperer/v0.0.28","lsp-antlr4/v0.1.1","chat-client/v0.1.2","chat-client/v0.1.1","lsp-codewhisperer/v0.0.27","lsp-codewhisperer/v0.0.26","lsp-codewhisperer/v0.0.25","lsp-codewhisperer/v0.0.24","lsp-codewhisperer/v0.0.23","lsp-codewhisperer/v0.0.21","lsp-codewhisperer/v0.0.20","chat-client/v0.1.0","lsp-codewhisperer/v0.0.19","lsp-codewhisperer/v0.0.18","chat-client/v0.0.9","lsp-codewhisperer/v0.0.17","chat-client/v0.0.8","chat-client/v0.0.7","lsp-codewhisperer/v0.0.16","chat-client/v0.0.6","chat-client/v0.0.5","chat-client/0.0.5","chat-client/v0.0.4","chat-client/0.0.4","lsp-codewhisperer/v0.0.15","lsp-codewhisperer@0.0.14","lsp-codewhisperer/v0.0.14","lsp-partiql/v0.0.4","lsp-codewhisperer/v0.0.13","lsp-yaml/v0.1.0","lsp-json/v0.1.0","lsp-codewhisperer/v0.0.12","lsp-codewhisperer/v0.0.11","lsp-partiql/v0.0.3","lsp-codewhisperer/v0.0.10","lsp-partiql@0.0.2","lsp-json@0.0.1","lsp-partiql@0.0.1","lsp-codewhisperer@0.0.6","lsp-codewhisperer@0.0.5","lsp-codewhisperer@0.0.4","lsp-codewhisperer@0.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12958.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}