CVE

CVE-2026-12958

8.5: CVSS 4.0
1: story

Severity: 8.5 High · vendor score
Published: Jun 23, 2026
Weakness: CWE-61

What it is

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.

From the National Vulnerability Database

Decipher coverage · 1 story

Newest first ↑

JUL 8
AIResearchers Find New GhostApproval Bug in Many AI Coding AssistantsThe bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links.DENNIS FISHER · 4 MIN

Official references

2 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record