CVE-2026-120497
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in AWS AI-DLC Workflows HTML Report Generator

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: AMZN

Description
Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120497

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AWS aidlc-traceability 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the HTML report generator of the aidlc-traceability CLI, part of AWS AI-DLC Workflows. An attacker who can modify a project's AI-DLC artifact files could inject malicious scripts into HTML traceability reports. When a user opens such a report in a browser, the injected script executes, potentially compromising the user's session.

Detection Guidance

To detect this vulnerability, check if your system has the aidlc-traceability CLI installed and if it is a version before commit 96cf0ea (fixed July 3, 2026). Inspect artifact titles and descriptions for crafted inputs that may contain script tags or HTML injection patterns. Review generated HTML reports for unexpected script execution.

Impact Analysis

If you open a compromised HTML report, an attacker could execute arbitrary scripts in your browser. This might allow them to steal session cookies, perform actions on your behalf, or access sensitive data. The impact depends on your permissions and the data accessible in the report.

Mitigation Strategies

Immediately remove any local copies of the aidlc-traceability CLI obtained before 2026-07-03 or update it to commit 96cf0ea or later. Avoid opening HTML reports from untrusted sources. Use Markdown output instead of HTML reports if possible. Regenerate reports only from trusted artifact files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...