The vulnerability identified as CVE-2026-12958 (CWE-61) affects AWS Language Servers due to missing validation of symbolic links. This allows an attacker with local access to craft a symlink that points outside the workspace trust boundary, enabling arbitrary file writes beyond intended restrictions. The issue is mitigated by upgrading the Language Servers for AWS to version 1.69.0 or higher. AWS manages this as a cloud service, and the vendor advisory confirms the availability of a fix.

An attacker with local user access can exploit this vulnerability to write files arbitrarily outside the workspace trust boundary, potentially leading to unauthorized modification of files and escalation of privileges within the affected environment. The CVSS 4.0 score of 8.5 reflects high impact due to the combination of local attack vector, low complexity, and high confidentiality, integrity, and availability impacts.

Upgrade the AWS Language Servers to version 1.69.0 or later, as this version contains the fix for the symlink validation vulnerability. Since this is a cloud service managed by AWS, the vendor handles remediation server-side. Users should verify they are using the updated version per the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-047-aws/.