Pattern: MCP Config Files in Repos Are the New RCE Supply-Chain Surface Across IDEs
The Hacker News·high signal
The Amazon Q CVE is one instance of a broader 2026 pattern — MCP configuration carried in repositories has become a remote-code-execution supply-chain surface, not just untrusted tool output. Research shows Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based prompt-injection/auto-launch attacks (Windsurf reportedly exploitable with zero user interaction), and large-scale scans like VIPER-MCP across ~40K repos produced 67 CVEs. The config file itself is now the attack vector.