CVE-2026-120497

Name of the Vulnerable Software and Affected Versions aidlc-traceability CLI in AWS AI-DLC Workflows versions prior to 2026-07-03

Description A stored cross-site scripting (XSS) issue exists in the HTML report generator. An attacker capable of modifying a project's AI-DLC artifact files can execute arbitrary scripts in the browser of a user who views a generated HTML traceability report by using crafted artifact titles or descriptions.

Recommendations Update to commit 96cf0ea or later. Remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03.