The vulnerability is a missing symlink validation that allows an attacker to create a link pointing to a file outside the trusted workspace and cause the Language Server to write data to that location. This results in unauthorized file modification, which can compromise system integrity. The flaw is a classic path traversal vulnerability (CWE‑61).

All instances of Amazon Web Services Language Servers for AWS that run a version earlier than 1.69.0 are affected. Users who run older releases or have not applied the 1.69.0 update must consider this vulnerability.

The CVSS score of 8.5 indicates a high severity. EPSS data is not available, so the likelihood of exploitation is uncertain at this time. The likely attack vector is local, as the description suggests that a user must open a maliciously crafted workspace to trigger the write. The flaw is not listed in the CISA KEV catalog, implying no confirmed public exploits yet. Nonetheless, the ability to arbitrarily write files outside the workspace boundary poses a significant risk to confidentiality and integrity.