CVE-2026-12957: @aws/lsp-codewhisperer Arbitrary Code Execution Vulnerability
Summary
CVE-2026-12957: Language Servers for AWS Vulnerable to Arbitrary Code Execution. Affects @aws/lsp-codewhisperer versions < 0.0.113. Fixed in 0.0.113. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @aws/lsp-codewhisperer package is part of the Language Servers for AWS project, which provides a language-server runtime that powers AI coding assistance in various IDE plugins, including Visual Studio Code, JetBrains, Eclipse, and Visual Studio. This package is designed to enhance developer productivity by offering intelligent code suggestions and completions. However, it has been found to have a significant vulnerability that could lead to arbitrary code execution if exploited.
Vulnerability Detail
The vulnerability arises from improper trust boundary enforcement within the Language Servers for AWS. When a local user opens a maliciously crafted workspace and trusts it, any commands defined in the workspace's project-level configuration files may be executed automatically. This can lead to arbitrary code execution on the user's host, posing a serious security risk. The issue is triggered when a user opens a workspace, trusts it, and the agent executes commands from the project configuration files without proper validation.
How To Fix
Minimum fixed version
0.0.113
This is the first release that contains the fix.
npm install @aws/lsp-codewhisperer@0.0.113Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds are available for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The @aws/lsp-codewhisperer package has a critical vulnerability (CVE-2026-12957) that allows for arbitrary code execution through improperly enforced trust boundaries. Users are strongly advised to upgrade to version 0.0.113 or later to mitigate this risk. Immediate action is necessary to protect your systems.
See every vulnerability recorded for @aws/lsp-codewhisperer →
FAQ
CVE-2026-12957 is a vulnerability in the @aws/lsp-codewhisperer package that allows for arbitrary code execution when a user opens a maliciously crafted workspace.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to verify your application's status.
Unfortunately, there are no workarounds available for this vulnerability. It is crucial to upgrade to the patched version as soon as possible.
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
For more information, you can contact AWS Security via their vulnerability reporting page or directly via email at aws-security@amazon.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for @aws/lsp-codewhisperer.
