CVE-2026-12957: Language Servers for AWS Vulnerable to Arbitrary Code Execution
Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer’s AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio).
Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed.
References
- aws.amazon.com/security/security-bulletins/2026-047-aws
- github.com/Amazon-Q-Developer/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458
- github.com/Amazon-Q-Developer/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410
- github.com/Amazon-Q-Developer/language-servers/pull/2708
- github.com/Amazon-Q-Developer/language-servers/pull/2711
- github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.65.0
- github.com/advisories/GHSA-xhcr-j4j9-3gh7
- github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7
- nvd.nist.gov/vuln/detail/CVE-2026-12957
Code Behaviors & Features
Detect and mitigate CVE-2026-12957 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →