CVE-2026-97662
MEDIUM
6,9
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,2
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: none
Integrity: high
Availability: high
Description
AI Translation Available
An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation.
To remediate this issue, users should upgrade to version 0.2.0.
73
External Control of File Name or Path
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Execute Unauthorized Code Or Commands
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Other)
Applicable Platforms
Operating Systems:
Unix, Windows, macOS
88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Read Application Data
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, PHP
https://aws.amazon.com/security/security-bulletins/2026-121-aws/
https://pypi.org/project/awslabs.security-agent-mcp-server/0.2.0/