CVE-2026-12958CWE-61

Arbitrary file write in Language Servers for AWS

High · published June 23, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.

To remediate this issue, users should upgrade to version 1.69.0 or higher.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00191 · 8.3th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-06-23T16:03Z
EPSS history
Timeline
  • 23 JUN 16:03Z
    Arbitrary file write in Language Servers for AWS
    cvelistv5