This page may contain stale information. Last updated: 2026-06-28
Overview
Amazon Q Developer is amazon’s AI-powered coding assistant bundled across IDE plugins (VS Code, JetBrains, Eclipse, Visual Studio). It runs on Language Servers for AWS and supports model-context-protocol for tool integration.
Recent Developments
- 2026-06-26: 2026-06-26-amazon-q-developer-cve-2026-12957-mcp — CVE-2026-12957/12958 disclosed (Bulletin 2026-047). Malicious
.amazonq/mcp.jsonauto-executed MCP servers without consent, inheriting AWS credentials (wiz research) - 2026-05-12: Fix deployed in Language Server 1.65.0 (CVE-2026-12957); full remediation in 1.69.0 (both CVEs)
- 2026-04-20: Responsible disclosure to AWS by Wiz Research
Security Notes
Warning
Pre-1.69.0 versions vulnerable to MCP auto-execution and symlink path traversal. Verify Language Server ≥1.69.0 after opening untrusted repos.
Affected plugin minimums (patched): VS Code ≥2.20, JetBrains ≥4.3, Eclipse ≥2.7.4, Visual Studio Toolkit ≥1.94.0.0.
Related
- amazon
- mcp
- model-context-protocol
- ai-coding-tools
- coding-agents
- supply-chain-security
- ai-agent-security
- wiz
- 2026-06-26-amazon-q-developer-cve-2026-12957-mcp