Stored Cross-Site Scripting Vulnerability in AWS AI-DLC Workflows

CVE-2026-120497

What is CVE-2026-120497?

The aidlc-traceability CLI in AWS AI-DLC Workflows is affected by a stored cross-site scripting vulnerability, where an attacker with the ability to modify project artifact files can inject arbitrary scripts. When users open the compromised HTML traceability report generated with altered artifact titles or descriptions, the malicious script is executed in their browsers. This poses a significant risk to users and underscores the importance of updating to version 96cf0ea or later, as earlier versions obtained before 2026-07-03 should be removed to mitigate this risk.

References