Advisoriesby IbisStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. Impacted versions: >=0.1.0 AND <commit 96cf0ea (fixed 2026-07-03) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article
Affected versions
Changes since it was listed
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- NVD
More AWS advisories
All AWS
Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetImproper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yetTemplate injection in the publishing component of Virtual Engineering WorkbenchCVE-2026-119085no fix yetImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in...CVE-2026-119301no fix yetLinux kernel IPv4 TCP use-after-free IssueCVE-2026-98432no fix yetInsertion of sensitive information into a log file and process argument list in the...CVE-2026-119117no fix yet