Loading vulnerability…
Arbitrary Code Execution via Workspace MCP Configuration in Language Servers for AWS
CVE-2026-12957 is an improper trust-boundary enforcement vulnerability in Language Servers for AWS before version 1.65.0 on all supported platforms, affecting Amazon Q Developer IDE integrations. After a user opens a malicious workspace and trusts it when prompted, the language server can automatically load project-controlled Model Context Protocol (MCP) server configurations and execute their commands without separate MCP execution approval. Spawned processes inherit the developer's environment, allowing attacker-controlled commands to execute with the user's permissions and access available credentials.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the developer environment through arbitrary command execution. Malicious processes can access or exfiltrate available AWS credentials, cloud authentication tokens, API keys, and other session secrets, and potentially use accessible SSH agents. Subsequent cloud compromise, lateral movement, persistence, or software supply-chain tampering depends on the developer's permissions and access.
If you can’t patch tonight, do this now.
No vendor-provided workaround is available. Until patched, avoid opening or trusting unfamiliar or unverified workspaces. Inspect project-level MCP configurations before permitting execution. Limit exposure by running unfamiliar projects in an isolated environment without cloud credentials or SSH-agent access and by restricting developer and cloud permissions.
Patch, then assume compromise.
Upgrade Language Servers for AWS to version 1.65.0 or later, which fixes CVE-2026-12957. AWS recommends version 1.69.0 or later to address the related, separate vulnerability CVE-2026-12958 as well. Update Amazon Q Developer IDE plugins to their latest releases. Reloading the IDE normally triggers the language-server update; if automatic updates are blocked, explicitly upgrade the plugin and verify the installed language-server version. Direct consumers of @aws/lsp-codewhisperer should upgrade to version 0.0.113 or later, and forked or derivative implementations should incorporate the fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.