CVE Tools
Track your stack

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

SecurityWeekBy Eduard Kovacs

PatchAmazon Q Developer

Our summary

Wiz reported a high-severity issue in the Amazon Q Developer extension for Visual Studio Code where opening a booby-trapped repository could trigger automatic actions on workspace configuration files without user consent. This could allow attackers to run attacker-controlled commands and inherit the developer’s environment, potentially capturing AWS or other cloud credentials and API keys—tracked as CVE-2026-12957, with a related symbolic link issue CVE-2026-12958. AWS issued patches (including fixes in the Amazon Q Developer language server, noted as version 1.65.0) and says updates are available for affected plugins covering VS Code, JetBrains, Eclipse, and Visual Studio.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsGhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding AgentsCVE-2026-12957, CVE-2026-12958
  2. The Hacker NewsAmazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP ConfigsCVE-2026-12957, CVE-2026-12958
  3. The Hacker News⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and MoreCVE-2026-12957
  4. Dark ReadingAmazon Q VS Extension Flaw Leads to Cloud Credential TheftCVE-2026-12957

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store