CVE-2026-12957 Amazon Q MCP Auto-Execution Spawning Shell from VS Code

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects unauthorized or malicious shell command execution spawned by the Amazon Q Developer VS Code extension, originating from a workspace-defined MCP (Model Context Protocol) server configuration file (.amazonq/mcp.json or .vscode/mcp.json) as associated with the CVE-2026-12957 vulnerability.