CVE-2026-12957

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted.

To remediate this issue, users should upgrade to Language Servers for AWS version 1.65.0 or higher.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Amazon Web Services	Language Servers for AWS	< 1.65.0

References

Timeline

Published: Jun 23, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-129587.8Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may o CVE-2026-12966.1The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 CVE-2026-129606.0An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to CVE-2026-129625.3A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by CVE-2026-129637.4A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.CVE-2026-129648.0A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.CVE-2026-129659.1The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL CVE-2026-129665.3The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in CVE-2026-129676.5The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any CVE-2026-129688.8The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload e CVE-2026-129695.3An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name(CVE-2026-129707.1The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Ref