Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Unrated

Arbitrary Code Execution in Language Servers for AWS Workspace MCP Configuration Handling

IdentifiersCVE-2026-12957CWE-501

CVE-2026-12957 is a high-severity arbitrary code execution vulnerability in Language Servers for AWS before version 1.65.0 on all supported platforms, affecting the runtime used by Amazon Q Developer integrations. The issue is caused by improper trust boundary enforcement when processing workspace/project configuration files, specifically reported in connection with Model Context Protocol (MCP) server configuration such as .amazonq/mcp.json. When a user opens a maliciously crafted workspace and trusts it when prompted, the language server may automatically load and execute commands defined in project configuration files. Reported analyses indicate that attacker-defined MCP server processes can be launched locally and inherit the developer’s environment, including credentials and tokens present in the session.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in arbitrary command execution on the developer’s machine in the context of the local user. Because the spawned processes may inherit the developer’s environment, the impact can extend to theft or misuse of AWS credentials, cloud CLI tokens, API keys, authentication tokens, and SSH agent access present in the session. This can enable unauthorized access to cloud resources, follow-on compromise of development environments, and potential pivoting into internal or production systems depending on the victim’s privileges.

Mitigation

If you can’t patch tonight, do this now.

No complete workaround is available in the provided content. Until upgrades are applied, do not open untrusted repositories or workspaces, and only trust workspaces from verified sources when prompted by the IDE. Where possible, restrict or monitor automatic component updates being blocked by enterprise network controls, and minimize exposure of sensitive credentials in developer environments when working with untrusted code.

Remediation

Patch, then assume compromise.

Upgrade Language Servers for AWS to version 1.65.0 or later to remediate CVE-2026-12957. AWS advisory content also recommends upgrading to Language Servers for AWS 1.69.0 or later and updating affected Amazon Q Developer IDE plugins to fixed releases or later. Existing installations may receive the updated language server automatically unless blocked by network controls; reloading the IDE may trigger the update. Ensure any bundled, forked, or derivative integrations incorporate the fixed language server version.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Amazon Web ServicesLanguage Servers For Awsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

security weekNews
Jun 26, 2026
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories - SecurityWeek

A high-severity vulnerability in Amazon Q Developer plugins/language server where workspace-embedded configuration files could be auto-executed without user permission, enabling attacker-controlled command execution and theft of cloud credentials and API keys from a developer environment.

Read more
the hacker newsNews
Jun 26, 2026
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A high-severity flaw in Amazon Q Developer / Language Servers for AWS that allowed a malicious repository to define an MCP server via .amazonq/mcp.json, leading to command execution and theft of developer cloud credentials after the workspace was trusted.

Read more
register securityNews
Jun 26, 2026
Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds

A high-severity arbitrary command execution vulnerability in Amazon Q for Visual Studio Code caused by automatically loading and executing MCP server configurations from a repository's .amazonq/mcp.json file without user consent or workspace trust checks, potentially exposing cloud credentials and other secrets.

Read more
cvefeed high severityNews
Jun 23, 2026
CVE-2026-12957 - Arbitrary Code Execution in Language Servers for AWS

An arbitrary code execution vulnerability in Language Servers for AWS caused by improper trust boundary enforcement. A local user who opens and trusts a maliciously crafted workspace may trigger automatic execution of commands from project configuration files.

Read more
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8

Community discussion across Reddit, Mastodon, and other social sources.