Amazon Q MCP Auto-Execution via Malicious .amazonq/mcp.json (CVE-2026-12957)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.