CVE-2026-12957 Amazon Q MCP Auto-Execution Shell Command Spawn

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects when development tools such as VS Code, VS Code OSS, or Node.js spawn a shell (bash/sh) to execute network-related commands (aws, curl, wget, npx). This behavior is characteristic of an adversary leveraging a developer's environment to download payloads, interact with cloud resources, or perform reconnaissance.