CVE-2026-12957CWE-732

Arbitrary Code Execution in Language Servers for AWS

High · published June 23, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted.

To remediate this issue, users should upgrade to Language Servers for AWS version 1.65.0 or higher.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00234 · 13.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-06-23T16:02Z
EPSS history
Timeline
  • 23 JUN 16:02Z
    Arbitrary Code Execution in Language Servers for AWS
    cvelistv5