CVE-2026-12957: AWS Language Servers arbitrary code execution in trusted workspaces

CVE-2026-12957 · Severity: high · CVSS 7.8 · Published 2026-06-23

AWS language servers used in Amazon Q Developer IDE plugins contain two security issues that could expose sensitive information to unauthorized parties. Amazon Q is a generative AI assistant that helps developers write code more efficiently within their development environments. If exploited, these vulnerabilities could allow attackers to intercept or access confidential data processed through the affected plugins, potentially compromising source code, credentials, or other sensitive information developers work with daily.

Technologies: Amazon AWS. Vendors: Amazon, Amazon Web Services, AWS, npm.

Quick answers

Is CVE-2026-12957 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12957 being exploited in the wild.
How severe is CVE-2026-12957?
High severity, with a CVSS score of 7.8, published 23 June 2026.
Which products and versions are affected?
Amazon Web Services Amazon Q Developer for Eclipse < 2.7.4; Amazon Web Services Amazon Q Developer for JetBrains < 4.3; Amazon Web Services Amazon Q Developer for Visual Studio Code < 2.20; Amazon Web Services AWS Toolkit with Amazon Q for Visual Studio < 1.94.0.0; and 2 more.
Is there a fix for CVE-2026-12957?
Yes. @aws/lsp-codewhisperer (npm): upgrade to 0.0.113 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12957 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-12957?
Check whether you run Amazon AWS, Amazon Web Services Amazon Q Developer for Eclipse, Amazon Web Services Amazon Q Developer for JetBrains or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @aws/lsp-codewhisperer (npm): upgrade to 0.0.113 or later
    npm install @aws/lsp-codewhisperer@0.0.113

Technical details

CVE-2026-12957 and CVE-2026-12958 are information disclosure vulnerabilities affecting the language server implementations bundled with AWS and Amazon Q Developer plugins. The vulnerabilities exist in the language server communication layer used by IDE extensions to provide code analysis and AWS integration features. Attack vectors and preconditions are not fully detailed in the available advisory content, but the issues likely involve improper handling of sensitive data within language server protocol (LSP) messages or local inter-process communication. An attacker with access to the affected development environment could potentially retrieve sensitive information such as credentials, API keys, or source code details. Patches or fixes should be obtained from the AWS security bulletin referenced in the advisory.

Affected products

  • AWS Language Servers for Amazon Q Developer plugins
  • AWS Amazon Q Developer IDE plugins

Identifiers

  • CVE-2026-12957
  • GHSA-xhcr-j4j9-3gh7

Timeline

  • 2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.