CVE-2026-12958

Arbitrary file write in Language Servers for AWS

Published Jun 23, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.

To remediate this issue, users should upgrade to version 1.69.0 or higher.

Analysis

Technical impact

The vulnerability is a missing symlink validation that allows an attacker to create a link pointing to a file outside the trusted workspace and cause the Language Server to write data to that location. This results in unauthorized file modification, which can compromise system integrity. The flaw is a classic path traversal vulnerability (CWE‑61).

Affected Systems

All instances of Amazon Web Services Language Servers for AWS that run a version earlier than 1.69.0 are affected. Users who run older releases or have not applied the 1.69.0 update must consider this vulnerability.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity. EPSS data is not available, so the likelihood of exploitation is uncertain at this time. The likely attack vector is local, as the description suggests that a user must open a maliciously crafted workspace to trigger the write. The flaw is not listed in the CISA KEV catalog, implying no confirmed public exploits yet. Nonetheless, the ability to arbitrarily write files outside the workspace boundary poses a significant risk to confidentiality and integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Amazon Web Services

Language Servers for AWS

unaffected

Version	Status	Constraints
`0`	affected	< 1.69.0

No data.

Vendor Product Versions

Amazon

Language Servers For Aws

Version	Status	Scheme	Platform
`[0,1.69.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Language Server to version 1.69.0 or newer to apply the fix for symlink validation.
Before opening any workspace, audit it to ensure that no symlinks point to paths outside the intended directories and avoid opening workspaces from untrusted sources.
Configure file system permissions so that only authorized processes can write to critical directories and enforce the workspace trust boundary at the operating‑system level.

Generated by OpenCVE AI on June 24, 2026 at 11:11 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-6v3r-4p5c-mrp5	Language Servers for AWS vulnerable to arbitrary file write

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.191% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://aws.amazon.com/security/security-bulletins/2026-047-aws/
https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5

History

Jun 23, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Amazon Amazon language Servers For Aws
Vendors & Products		Amazon Amazon language Servers For Aws

Jun 23, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 6:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5

Jun 23, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.
Title		Arbitrary file write in Language Servers for AWS
Weaknesses		CWE-61
References		https://aws.amazon.com/security/security-bulletins/2026-047-aws/
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`