CVE-2026-12957 | defend.network

What is CVE-2026-12957?

Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to Language Servers for AWS version 1.65.0 or higher.

CVSS7.8 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P8

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWECWE-732

NVD published2026-06-23

NVD last modified2026-06-23

Timeline

2026-06-23Published to the U.S. National Vulnerability Database (NVD)
2026-06-27First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Update Amazon Q Developer to the patched version
Review workspace trust settings and audit recent repository access
Rotate any cloud credentials that may have been exposed through compromised MCP configurations
Implement code review processes for external and newly-added repositories before workspace activation

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 5 of June 2026 (June 29 – July 5)
Vulnerability Priority Report – Week 4 of June 2026 (June 22 – 28)
Signal backup keys targeted; Linux kernel RCE; AWS Q credential theft (2026-06-27)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.