Description
Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.
To remediate this issue, users should upgrade to version 1.69.0 or higher.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon Web Services | Language Servers for AWS | < 1.69.0 | 1.69.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @aws/lsp-codewhisperer | < 0.0.117 | 0.0.117 | GHSA-6v3r-4p5c-mrp5 |
References
- https://aws.amazon.com/security/security-bulletins/2026-047-aws/ vendor-advisory
- https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5 third-party-advisory