AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by Language Servers for AWS Vulnerable to Arbitrary Code Execution? What should I do?

    Improper trust boundary enforcement in Language Servers for AWS may allow for arbitrary code execution.

    Affected: Language Servers for AWS version <1.65.0; npm/@aws/lsp-codewhisperer < 0.0.113. Fixed in: 1.65.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-12957-language-servers-for-aws (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: Language Servers for AWS version <1.65.0; npm/@aws/lsp-codewhisperer < 0.0.113. Fixed in: 1.65.0.

      • Check your version: run npm ls @aws/lsp-codewhisperer. Versions < 0.0.113 of @aws/lsp-codewhisperer are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install @aws/lsp-codewhisperer@0.0.113 (first patched version 0.0.113).
      2. Ensure any forked or derivative code is patched to incorporate the new fixes.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-12957-language-servers-for-aws (opens external site)

      Did this work for you?

    Add your answer or comment