2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
aws-lsp-codewhisperer
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting aws-lsp-codewhisperer, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-6v3r-4p5c-mrp5 | High | Language Servers for AWS vulnerable to arbitrary file write## Summary Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace containing a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. ## Impact If a user ope |
| GitHub (opens in a new tab) | |
| GHSA-xhcr-j4j9-3gh7 | High | Language Servers for AWS Vulnerable to Arbitrary Code Execution### Summary Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. ### Impact When a local user opens a maliciously crafted workspace and trusts it when prompted, co |
| GitHub (opens in a new tab) |
- GHSA-6v3r-4p5c-mrp5HighLanguage Servers for AWS vulnerable to arbitrary file write
< 0.0.117
## Summary Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace containing a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. ## Impact If a user ope
CVE: CVE-2026-12958
- GHSA-xhcr-j4j9-3gh7HighLanguage Servers for AWS Vulnerable to Arbitrary Code Execution
< 0.0.113
### Summary Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. ### Impact When a local user opens a maliciously crafted workspace and trusts it when prompted, co
CVE: CVE-2026-12957