Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories

Gbhackers •Eswar • June 27, 2026

A critical security flaw discovered in the Amazon Q Developer Extension for Visual Studio Code (VS Code) left developers vulnerable to arbitrary code execution and cloud credential theft. Tracked as CVE-2026-12957 and CVE-2026-12958, these high-severity vulnerabilities highlight significant risks in how AI coding assistants manage trust boundaries. The root cause of this vulnerability lies in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Amazon Q Developer Vulnerability Enables Cloud Credential Theft A high-severity vulnerability (CVE-2026-12957) in Amazon Q Developer for Visual Studio Code allowed attackers to execute arbitrary code and steal AWS credentials by automatically loading malicious MCP server configurations from cloned repositories. Discovered by Wiz Research, the flaw permits silent execution of commands without user consent, inheriting the developer's environment variables. Amazon patched the issue on May 12, 2026, but the public disclosure occurred on June 26, 2026. The vulnerability affects multiple IDEs, including Visual Studio Code, JetBrains, and Eclipse. Similar vulnerabilities have been reported in other AI coding tools, indicating a systemic risk in the development ecosystem. Users are advised to update to version 1.69.0 for comprehensive protection. 11 sources 74

Extracted Entities

Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (2)