CVE-2026-12958: Arbitrary file write in Language Servers for AWS
Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.
To remediate this issue, users should upgrade to version 1.69.0 or higher.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Language Servers for AWSto a version that resolves this vulnerability.Fixed in 1.69.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12958?
The severity of CVE-2026-12958 is rated as high with a score of 8.5.
How do I fix CVE-2026-12958?
To fix CVE-2026-12958, ensure that your workspace does not allow untrusted symlinks and validate symlink paths properly.
What does CVE-2026-12958 affect?
CVE-2026-12958 affects the Amazon AWS Toolkit for Visual Studio Code, specifically related to how it handles symlink validations.
What is the exploitation method for CVE-2026-12958?
CVE-2026-12958 can be exploited when a local user opens a workspace containing a maliciously crafted symlink.
What are the potential impacts of CVE-2026-12958?
The potential impacts of CVE-2026-12958 include arbitrary file write outside of the workspace trust boundary, leading to possible data compromise.