Bulletin ID: 2026-163-AWS
Publication Date: 11/02/2026 11:00 AM PST
Description:
aidlc-traceability is an open source command-line tool, formerly published in the awslabs/aidlc-workflows repository, that generates traceability-matrix reports from a project's AI-DLC artifact files. We identified CVE-2026-120497, where stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI could allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.
Impacted versions: >=0.1.0 AND <commit 96cf0ea (fixed 2026-07-03)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.