CVE-2026-12958: @aws/lsp-codewhisperer Arbitrary File Write Vulnerability
Summary
CVE-2026-12958: Language Servers for AWS vulnerable to arbitrary file write. Affects @aws/lsp-codewhisperer versions < 0.0.117. Fixed in 0.0.117. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @aws/lsp-codewhisperer package is part of the Language Servers for AWS project, which implements the Language Server Protocol to enhance developer tooling across various IDEs, including VS Code, JetBrains, Visual Studio, and Eclipse. This package facilitates features like code completion and error checking, improving the overall development experience. However, it is vulnerable to a significant security flaw that allows for arbitrary file writes due to inadequate symlink validation.
Vulnerability Detail
The vulnerability arises from missing symlink validation in the @aws/lsp-codewhisperer package. When a user opens a workspace containing a maliciously crafted symlink that points to a file path outside the workspace trust boundary, the language server may follow this symlink and write to an external location without user consent. This can lead to unauthorized modifications of files outside the intended workspace, posing a serious security risk.
How To Fix
Minimum fixed version
0.0.117
This is the first release that contains the fix.
npm install @aws/lsp-codewhisperer@0.0.117Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds are available for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The @aws/lsp-codewhisperer package is vulnerable to an arbitrary file write issue due to inadequate symlink validation. Users are strongly advised to upgrade to version 0.0.117 or later to mitigate this risk. Regular monitoring of open-source vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for @aws/lsp-codewhisperer →
FAQ
The vulnerability allows for arbitrary file writes due to missing symlink validation, which can lead to unauthorized file modifications.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
While there are no workarounds available, it is crucial to prioritize upgrading to the patched version to mitigate the risk.
For further inquiries, you can reach out to AWS Security via their vulnerability reporting page or email aws-security@amazon.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for @aws/lsp-codewhisperer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
