CVE-2026-12957: Language Servers for AWS Vulnerable to Arbitrary Code Execution
Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer’s AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio).
Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed.
References
- aws.amazon.com/security/security-bulletins/2026-047-aws
- github.com/Amazon-Q-Developer/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458
- github.com/Amazon-Q-Developer/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410
- github.com/Amazon-Q-Developer/language-servers/pull/2708
- github.com/Amazon-Q-Developer/language-servers/pull/2711
- github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.65.0
- github.com/advisories/GHSA-xhcr-j4j9-3gh7
- github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7
- nvd.nist.gov/vuln/detail/CVE-2026-12957
Code Behaviors & Features
Detect and mitigate CVE-2026-12957 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →