Amazon addressed security flaws in the Amazon Q Developer VS Code extension that enabled prompt injection, secrets exfiltration (including API keys), and remote code execution. The underlying language server was updated to v1.24.0 and the extension now requires additional human-in-the-loop approval; restarting the plugin triggers the update. AWS declined to assign CVEs, stating the issues do not meet CNA criteria and characterizing exploitation as executing deliberately malicious code rather than an inherent vulnerability. AWS has not publicly published security bulletins about these fixes. Researcher Johann Rehberger reported the flaws and urged greater transparency.
"We're aware of this research and have made enhancements to the underlying language server (v1.24.0) as part of the Amazon Q Developer Extension for VS Code to address the behavior mentioned in the blog post," an AWS spokesperson told The Register.
"Restarting the plugin will update it to the latest version that requires additional human-in-the-loop approval."
"This is not a vulnerability in the same way executing any other deliberately malicious code is not considered a vulnerability," an AWS spokesperson told The Register.
"We recommend customers follow security best practices to avoid executing deliberately malicious code."
#amazon-q-developer #vs-code-extension #prompt-injection #remote-code-execution #secrets-exfiltration
Collection
[
|
...
]