CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer Plugins
And Amazon ยท 2026-10-19
Actions
Technical Details
| Affected Versions | < 1.69.0, < 2.20, < 4.3, < 2.7.4, < 1.94.0.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-12957, CVE-2026-12958 |
| Migration Required | Yes |
| Cost Impact | Neutral |
What This Means
For DevOps Teams
Update all instances of Language Servers for AWS and corresponding Amazon Q Developer plugins to version 1.69.0 or later to address critical security vulnerabilities and prevent potential exploitation of improper trust boundary enforcement and missing symlink validation issues.
For Platform Teams
Deploy the latest version of Language Servers for AWS (1.69.0) across all integrated development environments to ensure security compliance and maintain the reliability of AI coding assistance features.
For Executives
Implement immediate upgrades to Language Servers for AWS and Amazon Q Developer Plugins to mitigate security risks associated with CVE-2026-12957 and CVE-2026-12958, ensuring the integrity and trustworthiness of AI-driven coding assistance across all supported IDEs.