Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, let a malicious repository run commands and steal a developer's cloud credentials by having the assistant read an MCP configuration file, .amazonq/mcp.json,...