Live › vulnerability › CVE-2026-120497
The aidlc-traceability CLI in AWS AI-DLC Workflows does not escape artifact titles and descriptions when it writes HTML traceability reports. An attacker who can edit a project's AI-DLC artifact files can run script in the browser of anyone who opens a generated report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Teams that generate HTML traceability reports with the aidlc-traceability CLI from AWS AI-DLC Workflows before 2026-07-03 are exposed, mainly where artifact files can be edited by others. Anyone who opens a generated report in a browser can be hit. Teams that never used the CLI or already have a newer copy can skip it.
No product ranges from the sources yet.
96cf0ea or later.96cf0ea or later.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/02/2026 11:00 AM PST
Description:
aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.
Impacted versions: >=0.1.0 AND <commit 96cf0ea (fixed 2026-07-03)
Resolution:
This issue has been addressed in aidlc-traceability at commit 96cf0ea (2026-07-03). The CLI was subsequently removed from the awslabs/aidlc-workflows repository on 2026-07-16 and is no longer maintained there; an agent-native re-implementation is maintained separately at aws-samples/sample-aidlc-traceability. We recommend removing any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or updating it to commit 96cf0ea or later, and ensuring any forked or derivative code incorporates the fix.
Workarounds:
Do not open HTML reports generated by an unpatched copy of the tool from untrusted projects. Use the Markdown report output instead of HTML, or regenerate reports only from artifact files you control, until the local copy is updated or removed.
References:
Acknowledgement:
We would like to thank Vignesh Kumar for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-120497")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.