CVE-2026-12958

high

Description

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.

References

https://aws.amazon.com/security/security-bulletins/2026-047-aws/

https://thehackernews.com/2026/07/ghostapproval-symlink-flaws-could-let.html

https://hackread.com/ghostapproval-flaws-ai-coding-tools-outside-workspace/

https://www.theregister.com/security/2026/07/08/bug-in-top-ai-coding-agents-shows-that-unix-era-security-headaches-never-really-die/5268025

https://www.securityweek.com/amazon-q-flaw-enabled-cloud-credential-theft-via-malicious-repositories/

https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html

https://github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5

Details

Source: Mitre, NVD

Published: 2026-06-23

Updated: 2026-06-23

Named Vulnerability: GhostApproval

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.5

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00142