Search threats, CVEs… ⌘K
Back to vendor advisories
AWS Security BulletinsCVE-2026-12957

CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins

Bulletin ID: 2026-047-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/23/2026 09:30 AM PDT Description: Language Servers for AWS provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). We identified CVE-2026-12957, an improper trust boundary enforcement issue in Language Servers for AWS before version 1.65.0. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted. We identified CVE-2026-12958, a missing symlink-validation issue in Language Servers for AWS before version 1.69.0. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. These issues affect the Amazon Q Developer IDE plugins, which bundle Language Servers for AWS. Both issues are remediated in Language Servers for AWS version 1.69.0. Affected products & versions:- Language Servers for AWS: < 1.69. - Amazon Q Developer for Visual Studio Code: < 2.20- Amazon Q Developer for JetBains: < 4.3- Amazon Q Developer for Eclipse: < 2.7.4- AWS Toolkit with Amazon Q for Visual Studio: < 1.94.0.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read the vendor bulletin
Not listedCVSS not listedNot listed severity
Scope

What the vendor says is affected

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

Next step

What the vendor recommends

Both issues are remediated in Language Servers for AWS version 1.69.0.

Review the complete instructions on the vendor's site
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory's last-updated date.
Timeline

When this advisory changed

  1. Added to SecurityAlert

    We collected the advisory from the official source.

  2. Published by AWS

    The publication date reported by the vendor.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-12957View CVSS, KEV, EPSS, and threat contextCVE-2026-12958View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor