CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 11/02/2026 11:00 AM PST
Description:
aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.
Impacted versions: >=0.1.0 AND <commit 96cf0ea (fixed 2026-07-03)
Resolution:
This issue has been addressed in aidlc-traceability at commit 96cf0ea (2026-07-03). The CLI was subsequently removed from the awslabs/aidlc-workflows repository on 2026-07-16 and is no longer maintained there; an agent-native re-implementation is maintained separately at aws-samples/sample-aidlc-traceability. We recommend removing any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or updating it to commit 96cf0ea or later, and ensuring any forked or derivative code incorporates the fix.
Workarounds:
Do not open HTML reports generated by an unpatched copy of the tool from untrusted projects. Use the Markdown report output instead of HTML, or regenerate reports only from artifact files you control, until the local copy is updated or removed.
References:
Acknowledgement:
We would like to thank Vignesh Kumar for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.