Language Servers for AWS vulnerable to arbitrary file write

[ Description ]Official description

Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. To remediate this issue, users should upgrade to version 1.69.0 or higher.

[ Fixes ]Fixes and patches

• @aws/lsp-codewhisperer 0.0.117Fixed version · GitHub Advisories · npm package @aws/lsp-codewhisperer: upgrade to 0.0.117 or later (affected < 0.0.117)

[ Packages ]Affected open-source packages

• @aws/lsp-codewhisperer npmAffected < 0.0.117 · fixed in 0.0.117 · GHSA-6v3r-4p5c-mrp5

[ References ]References

• aws.amazon.com/security/security-bulletins/2026-047-awsvendor-advisory
• github.com/aws/language-servers/security/advisories/GHSA-6v3r-4p5c-mrp5third-party-advisory