npm/@aws/lsp-codewhisperer CVE-2026-12957: high 7.8, EPSS 0.23%

Language Servers for AWS Vulnerable to Arbitrary Code Execution

Action: Upgrade @aws/lsp-codewhisperer to 0.0.113 or later.

npm i @aws/lsp-codewhisperer@0.0.113

Affected

Fixed versions

Sources

• osv: GHSA-xhcr-j4j9-3gh7
• nvd: CVE-2026-12957
• https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7
• https://github.com/Amazon-Q-Developer/language-servers/pull/2708
• https://github.com/Amazon-Q-Developer/language-servers/pull/2711
• https://github.com/Amazon-Q-Developer/language-servers/commit/7b8595a4e638562f79d5f71dcf22b0c700490458
• https://github.com/Amazon-Q-Developer/language-servers/commit/f5aa1a3b25aa38bfe8dd0e830b5839e1cea1d410
• https://aws.amazon.com/security/security-bulletins/2026-047-aws
• https://github.com/Amazon-Q-Developer/language-servers/releases/tag/agentic-rc-1.65.0
• https://github.com/aws/language-servers

CVE-2026-12957 · published 2026-09-24T19:13:53Z · modified 2026-09-24T19:30:05.274534811Z · JSON