CVE-2026-12957 MCP Auto-Execution: AI Coding Tool Spawning Node/Python

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•7

Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.