CVE-2026-12958

Amazon Q language server writes through unvalidated symlinks

Amazon Web Services · Language Servers for AWS / Amazon Q Developer

First documented disclosure · Review checkpoint

Summary

A trusted workspace containing a malicious symlink can redirect an agent write outside the workspace.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Missing symlink validation crosses the file-write boundary.

Conditions required

The user opens and trusts the workspace, then the agent writes through the crafted link.

Potential impact

Modification of files outside the intended workspace.

Affected versions and configurations

Language Servers for AWS before 1.69.0; @aws/lsp-codewhisperer before 0.0.117.

Fix and mitigation status

Language server 1.69.0; @aws/lsp-codewhisperer 0.0.117.

Practical next steps

Upgrade the bundled language server/plugin; verify auto-update completed, including derivative deployments.

Operating lesson

Authorize the resolved destination of a write, not only its displayed workspace path.

Evidence and limits

Public advisory June 23 predates July 8 GhostApproval coverage. AWS lists no workaround; patching this component does not resolve every vendor’s symlink behavior.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources