Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120497— Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Quick assessment

Affected

AWS aidlc-traceability

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 2026 年 7 月 3 日之前，AWS AI-DLC 工作流中的命令行工具（CLI）的 HTML 报告生成器存在存储型跨站脚本（XSS）漏洞。该漏洞可能允许能够修改项目 AI-DLC 工件文件的攻击者，通过精心构造的工件标题或描述，在用户打开生成的 HTML 可追溯性报告时，于其浏览器中执行任意脚本。为修复此问题，用户应删除在 2026 年 7 月 3 日之前获取的任何 CLI 本地副本，或将其更新至 commit 96cf0ea 或更高版本。该 CLI 已于 2026 年 7 月 16 日从代码仓库中移

CVSS 5.0 · Medium EPSS 0.25% · P16 Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
AWS	aidlc-traceability	`< 96cf0eaa31a3ad8636e486c7fd2b91c55166393f`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Source: CVE Program / CVE List V5

Vulnerability Description

Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
AWS	aidlc-traceability	0 ~ 96cf0eaa31a3ad8636e486c7fd2b91c55166393f	-

II. Public POCs for CVE-2026-120497

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120497

请登录查看更多情报信息。

Other References for CVE-2026-120497 (3)

https://github.com/awslabs/aidlc-workflows/commit/96cf0eaa31a3ad8636e486c7fd2b91c55166393f patch
https://aws.amazon.com/security/security-bulletins/2026-163-aws/ vendor-advisory
https://github.com/awslabs/aidlc-workflows/security/advisories/GHSA-gjmq-52p3-7fh2 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120497

Same Patch Batch · AWS · 2026-11-02 · 4 CVEs total

CVE-2026-119085	8.8 HIGH	Template injection in the publishing component of awslabs Virtual Engineering Workbench
CVE-2026-119301	7.9 HIGH	Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in A
CVE-2026-116635	6.1 MEDIUM	Improper limitation of a pathname to a restricted directory in the deployment status compo

IV. Related Vulnerabilities

Same vendor: AWS

Same weakness: CWE-79