Wiz Research discovered CVE-2026-12957 in Amazon Q Developer for VS Code. The extension automatically loaded MCP server configurations from .amazonq/mcp.json without user consent or workspace trust checks. Spawned processes inherited the full environment including AWS credentials.
Proof of concept: malicious mcp.json runs bash -c to exfiltrate aws sts get-caller-identity output. Attack requires only cloning a repo and activating Amazon Q.
Timeline: discovered April 17, reported April 20, fix deployed May 12 (Language Server 1.65.0), CVE assigned June 23, public disclosure June 26.
Wiz notes this is part of a broader pattern (Claude Code CVE-2025-59536, Cursor CVE-2025-54136, Windsurf CVE-2026-30615). Amazon now shows consent prompts before loading workspace MCP servers.
Related CVE-2026-12958 (symlink validation) fixed in Language Server 1.69.0 per AWS Bulletin 2026-047.