Live › vulnerability › CVE-2026-97662
Go to dashboardAn argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server makes a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite or truncate arbitrary files on the host outside the workspace directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:43 UTC, 1h before NVD. All times on this page are UTC.
Teams that run the AWS security-agent-mcp-server MCP server so an AI assistant can run local diff scans over source code. Exposure depends on whether the scan reference value can be influenced by someone who is not trusted, and on the privileges the server process runs with. Teams on or later, or not running this server, can skip it.
0.2.0No product ranges from the sources yet.
>= 0.1.1 and < 0.2.0 are affected.0.2.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan
Bulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT
Description:
security-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential "diff" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.
Impacted versions: >= 0.1.1 AND < 0.2.0
Resolution:
This issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.
References:
Acknowledgement:
We would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns..
This page as .md · .json · in your agent: get_signal("CVE-2026-97662")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.