GHSA-gjmq-52p3-7fh2: Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions.
To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aidlc-traceability CLIto a version that resolves this vulnerability.Patch 96cf0ea - Remove
Remove
aidlc-traceability CLIfrom your environment.Remove any local copy obtained before 2026-07-03.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who open HTML traceability reports generated by a local aidlc-traceability CLI obtained before 2026-07-03 are exposed if an actor can modify the project's AI-DLC artifact files. The crafted content is executed in the browser of the user opening the report.
What access does an attacker need to exploit it?
The attacker needs the ability to modify a project's AI-DLC artifact files. They can place crafted content in artifact titles or descriptions, which is then stored in the generated HTML report.
Does exploitation require a user action?
Yes. A user must open a generated HTML traceability report containing the crafted artifact content for the script to execute in that user's browser.
What should be done if an older local CLI copy is present?
Remove any local aidlc-traceability CLI copy obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.