CVE
CVE-2026-12958
Arbitrary file write in Language Servers for AWS
Exploitation IoCs 3
Filename project_settings.json
Filename ~/.ssh/authorized_keys
Filename ~/.zshrc
MITRE ATT&CK TTPs 8
T1005 T1059 T1059.003 T1082 T1083 T1087.004 T1542.001 T1548.003
Data from Local System
Collection
Command and Scripting Interpreter
Execution
Windows Command Shell
Execution
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Cloud Account
Discovery
System Firmware
Persistence
Sudo and Sudo Caching
Privilege Escalation
Source Articles
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Researchers at Wiz discovered a vulnerability pattern called GhostApproval affecting multiple AI coding assistants, including Amazon Q Developer, Claude Code, and Cursor. The flaw exploits symbolic links (symlinks) to redirect file writes to sensitive system files, such as SSH authorized_keys or shell startup files, bypassing user consent by showing misleading approval prompts. While some vendors have issued fixes, others dispute the severity, and the issue highlights a systemic design weakness in how AI agents handle file operations and user approvals.
hacker-news Jul 9, 2026
GhostApproval: A Trust Boundary Gap in AI Coding Assistants
GhostApproval is a trust boundary vulnerability affecting multiple AI coding assistants, where malicious repositories use symbolic links to trick agents into accessing or modifying files outside the intended workspace sandbox. The attack exploits symlink following (CWE-61) and UI misrepresentation (CWE-451), allowing adversaries to silently write to sensitive system files such as ~/.ssh/authorized_keys or ~/.zshrc. Despite confirmation prompts, users are often misled about the actual file being modified, leading to potential remote code execution and persistent access. Vendors including AWS, Cursor, and Google have issued fixes, while others have acknowledged or rejected the issue.
wiz