Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace containing a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary. Impact If a user opens a maliciously crafted workspace containing a symlink that resides within the workspace but resolves to a location outside the workspace trust boundary, the agent may follow that symlink and write to the external location without prompting the user for approval. This can result in the modification of files outside the intended workspace boundary. This issue is triggered when a user opens a workspace,…
Recommended action: Upgrade to 0.0.117 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Language Servers for AWS (the aws/language-servers project) provide the underlying language-server runtime that powers Amazon Q Developer's AI coding assistance across its IDE plugins (Visual Studio Code, JetBrains, Eclipse, and Visual Studio). Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. Impact When a local user opens a maliciously crafted workspace and trusts it when prompted, commands defined in the workspace's project-level configuration files may be executed automatically, resulting in arbitrary code execution on the user's host. This issue is triggered when a user opens a workspace, trusts it, and the agent subsequently executes commands defined in the project-level configuration files. Impacted versions: Language Servers for AWS version <1.65.0. Patches This issue has been…
Recommended action: Upgrade to 0.0.113 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.