Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal
Vulnerabilities

Malicious workspaces could hijack Amazon Q Developer, AWS says

Two flaws in the language servers behind AWS's AI coding assistant allowed command execution and file writes outside the trusted workspace, both now patched.

By The Agentic Times ·

A digital agent sits at a desk in a locked room, unaware that invisible hands from outside the walls are typing commands on its keyboard, writing files into drawers it shouldn't touch.
A digital agent sits at a desk in a locked room, unaware that invisible hands from outside the walls are typing commands on its keyboard, writing files into drawers it shouldn't touch. · Illustration: The Agentic Times

AWS has disclosed two vulnerabilities in Language Servers for AWS, the runtime that powers Amazon Q Developer's AI coding assistance across Visual Studio Code, JetBrains, Eclipse and Visual Studio. Both advisories were published on 24 September 2026. Together they allowed arbitrary code execution and arbitrary file writes on a developer's machine when that developer opened a maliciously crafted workspace and trusted it.

The first issue, tracked as CVE-2026-12957, is described by AWS as improper trust boundary enforcement. According to the advisory, if a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically. The result is arbitrary code execution on the user's host. The advisory says the issue is triggered when a user opens a workspace, trusts it, and the agent then runs the commands in those project-level configuration files. Versions of Language Servers for AWS below 1.65.0 are affected, and AWS says the problem was fixed in 1.65.0.

The second issue, CVE-2026-12958, is a missing symlink validation flaw. A symlink is a file that points at another location on disk. According to the advisory, a workspace can contain a symlink that sits inside the workspace but resolves to a path outside the workspace trust boundary. If the agent writes to that path, it follows the symlink and writes to the external location without asking the user for approval. That can modify files outside the intended workspace. As with the first flaw, the trigger is a user opening a workspace, trusting it, and the agent subsequently writing to a path within that workspace. Versions below 1.69.0 are affected, and AWS says the issue has been addressed in version 1.69.0.

Both advisories name the affected npm package as @aws/lsp-codewhisperer. AWS states that no workarounds are available for either vulnerability. The company recommends upgrading to the latest version and says users should ensure any forked or derivative code incorporates the new fixes.

The pattern in both cases is the same. A developer's decision to trust a workspace is treated by the tooling as permission for the coding agent to act, and the agent then acts on content that the attacker controls. In the first flaw that content is a project configuration file containing commands. In the second it is a symlink that quietly redirects a write outside the folder the user thought they were working in. Neither requires the attacker to have access to the victim's machine beyond persuading them to open a project.

AWS Security credited Wiz and Maor Dokhanian with collaborating on both issues through its coordinated vulnerability disclosure process. The advisories ask that questions be directed to AWS Security through its vulnerability reporting page or by email, and that researchers not open public GitHub issues.

Developers running Amazon Q Developer plugins should check the version of the underlying language server in use. Because the two fixes landed in different releases, 1.65.0 and 1.69.0, only version 1.69.0 or later covers both problems.

Sources

  1. github.comhttps://github.com/advisories/GHSA-xhcr-j4j9-3gh7
  2. github.comhttps://github.com/advisories/GHSA-6v3r-4p5c-mrp5