VYPR
← All advisories
High severity7.8NVD Advisory· Published Jun 23, 2026· Updated Jun 23, 2026

CVE-2026-12958

CVE-2026-12958

Description

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.

To remediate this issue, users should upgrade to version 1.69.0 or higher.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@aws/lsp-codewhisperernpm
< 0.0.1170.0.117

Affected products

2

Patches

Vulnerability mechanics

References

9

News mentions

7