Amazon Q Developer symlink approval-dialog bypass (GhostApproval)
Amazon Q Developer's file-write approval dialog displayed the pre-resolution path while the write followed a symlink to a different target. Fixed in Language Server 1.69.0.
- Vendor
- Amazon
- Product
- Q Developer (Language Server)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Is CVE-2026-12958 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-12958 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-23 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-23. Full cross-catalog view: /kev-comparison
CVE-2026-12958 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Affected: Amazon Q Developer Language Server prior to 1.69.0. The file-write approval dialog rendered the file path the assistant asked to modify, not the resolved target after symbolic-link traversal. A booby-trapped repository could place a symlink at the requested path pointing at a sensitive file elsewhere on the developer’s machine — shell rc files, SSH configuration, tool credentials — and the write following the “approve” click would land on the linked target rather than the file the developer saw in the dialog. No network position or elevated privileges required beyond the ability to get the repository opened in an authenticated Q Developer session.
The bug is one of six Wiz disclosed as GhostApproval on 2026-07-08 across the AI-coding-assistant market. Wiz reports no observed in-wild exploitation as of publication.
What to do
- Upgrade Amazon Q Developer Language Server to 1.69.0 or later.
- Where the assistant runs against untrusted repositories, keep it under a user account or sandbox that cannot reach
~/.ssh, shell rc files, or the assistant’s own configuration — the consent dialog is not the last line of defense on this class of bug, and never has been.
