CVE-2026-120497

    Dashboard / Vulnerabilities / CVE-2026-120497

    CVE-2026-120497

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary: Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

    Details: Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

    References: https://aws.amazon.com/security/security-bulletins/2026-163-aws/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120497.json, https://github.com/awslabs/aidlc-workflows/security/advisories/GHSA-gjmq-52p3-7fh2, https://nvd.nist.gov/vuln/detail/CVE-2026-120497, https://github.com/awslabs/aidlc-workflows/commit/96cf0eaa31a3ad8636e486c7fd2b91c55166393f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -96cf0eaa31a3ad8636e486c7fd2b91c55166393f

    Affected versions

    v1.0.1
    v1.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120497 | CVE-DB