Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.

To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• aws.amazon.com/security/security-bulletins/2026-163-aws Üretici bülteni
• github.com/…ommit/96cf0eaa31a3ad8636e486c7fd2b91c55166393f Yama
• github.com/…kflows/security/advisories/GHSA-gjmq-52p3-7fh2 Üçüncü taraf

Kayıt geçmişi

1. 2 Kas 2026 22:06Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-119735Munshi XSS via Purchase Inquiry Thread Rendering
• 8,4 CVE-2026-111048FOSSBilling destek talebi notlarında depolanmış XSS açığı
• 6,1 CVE-2026-120500An Otter Wiki before 2.26.2 Stored XSS via Math Code Block
• 6,1 CVE-2026-2102XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter
• 5,4 CVE-2026-120491Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
• 5,4 CVE-2026-120488LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content