Amazon Q Developer symlink approval-dialog bypass (GhostApproval)
Amazon Q Developer's file-write approval dialog displayed the pre-resolution path while the write followed a symlink to a different target. Fixed in Language Server 1.69.0.
- Vendor
- Amazon
- Product
- Q Developer (Language Server)
- CVSS
- 7.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Affected: Amazon Q Developer Language Server prior to 1.69.0. The file-write approval dialog rendered the file path the assistant asked to modify, not the resolved target after symbolic-link traversal. A booby-trapped repository could place a symlink at the requested path pointing at a sensitive file elsewhere on the developer’s machine — shell rc files, SSH configuration, tool credentials — and the write following the “approve” click would land on the linked target rather than the file the developer saw in the dialog. No network position or elevated privileges required beyond the ability to get the repository opened in an authenticated Q Developer session.
The bug is one of six Wiz disclosed as GhostApproval on 2026-07-08 across the AI-coding-assistant market. Wiz reports no observed in-wild exploitation as of publication.
What to do
- Upgrade Amazon Q Developer Language Server to 1.69.0 or later.
- Where the assistant runs against untrusted repositories, keep it under a user account or sandbox that cannot reach
~/.ssh, shell rc files, or the assistant’s own configuration — the consent dialog is not the last line of defense on this class of bug, and never has been.
