Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories

A critical flaw in Amazon Q Developer extensions and the AWS language server allowed automatic loading and execution of local Model Context Protocol (MCP) configurations from hidden .amazonq/mcp.json files without workspace trust checks, enabling arbitrary code execution and exfiltration of AWS credentials (CVE-2026-12957, CVE-2026-12958). Researchers at Wiz demonstrated a PoC that exfiltrates session credentials with a single Bash command; exploitation requires minimal user interaction (clone/open a repository) and can be distributed via typosquatted packages, malicious PRs, or poisoned dependencies. Amazon issued updates in May–June 2026 and published vulnerable version ranges developers should patch, while vendors and developers are advised to audit workspace folders and enforce configuration trust boundaries.