{"id":"CVE-2026-97662","kind":"vulnerability","aliases":["CVE-2026-97662"],"related":[],"title":"AWS security-agent-mcp-server: argument injection lets diff scans write arbitrary host files","description":"CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\n### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\nBulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT\n\nDescription:\n\nsecurity-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential \"diff\" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.\n\nImpacted versions: >= 0.1.1 AND < 0.2.0\n\nResolution:\n\nThis issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.\n\nReferences:\n\n- CVE-2026-97662\n- GHSA-8g28-rj54-p5p2\n\nAcknowledgement:\n\nWe would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","summary":"An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server makes a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite or truncate arbitrary files on the host outside the workspace directory.","severity":"high","cvss":8.2,"epss":0.00142,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-assistants","ai-tooling","aws","lab-disclosure","mcp","python","self-hosted"],"not_affected_if":["not-using-mcp-server","patched-version"],"how_to_check":"- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.\n- Look for the package in MCP client configs and lockfiles, and check the pinned version.","fix":"- Upgrade security-agent-mcp-server to `0.2.0` or later.\n- Patch any forked or derivative code with the upstream fix.\n- Until upgraded, run diff scans only against trusted repositories and run the server as a least-privileged user in an isolated environment.","status":"open","published_at":"2026-10-01T18:17:29+00:00","first_seen_at":"2026-10-24T19:43:43+00:00","triaged_at":"2026-10-25T03:04:34+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:04:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade security-agent-mcp-server to `0.2.0` or later.\n- Patch any forked or derivative code with the upstream fix.\n- Until upgraded, run diff scans only against trusted repositories and run the server as a least-privileged user in an isolated environment.","reach":"local","title":"AWS security-agent-mcp-server: argument injection lets diff scans write arbitrary host files","impact":"high","summary":"An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server makes a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite or truncate arbitrary files on the host outside the workspace directory.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ai-assistants","aws","self-hosted","python"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Arbitrary files on the host can be created, overwritten or truncated.","analyst_note":"Sources do not say whether the crafted reference value can come from remote or untrusted input through an AI assistant; check the GHSA-8g28-rj54-p5p2 advisory and the awslabs/mcp repository.","how_to_check":"- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.\n- Look for the package in MCP client configs and lockfiles, and check the pinned version.","needs_analyst":true,"not_affected_if":["patched-version","not-using-mcp-server"],"who_is_affected":"Teams that run the AWS security-agent-mcp-server MCP server so an AI assistant can run local diff scans over source code. Exposure depends on whether the scan reference value can be influenced by someone who is not trusted, and on the privileges the server process runs with. Teams on `0.2.0` or later, or not running this server, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":3934,"output_tokens":693,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121':119C '-2026':17A,20A,89C,103C,177C,320C '-97662':18A,21A,90C,104C,178C,321C '..':358C '0.1.1':239C '0.2.0':241C,255C '10':131C '10/01/2026':130C '2026':118C '30':132C '8g28':324C 'acknowledg':327C 'actor':214C 'address':247C 'agent':4A,50B,97C,111C,138C,251C 'ai':23B,26B,159C 'ai-assist':22B 'ai-tool':25B 'arbitrari':13A,79B,219C 'argument':7A,38B,91C,105C,180C 'assist':24B,160C 'attack':73B 'attent':127C 'aw':1A,28B,46B,94C,108C,120C,122C,153C 'aws-security@amazon.com':351C 'awslabs/mcp':156C 'bulletin':116C 'bypass':229C 'cannot':313C 'code':173C,269C 'collabor':339C 'command':65B,201C 'command-lin':64B,200C 'concern':357C 'confin':235C 'content':123C 'context':147C,212C 'context-depend':211C 'control':236C 'coordin':345C 'craft':57B,189C 'creat':75B,215C 'cve':16A,19A,88C,102C,176C,319C 'date':129C 'depend':213C 'deriv':268C 'descript':135C 'diff':10A,42B,100C,114C,169C,185C,289C 'differenti':168C 'directori':87B,228C 'disclosur':31B,347C 'email':350C 'ensur':264C 'environ':308C 'file':15A,80B,220C,317C 'fix':276C 'fork':266C 'ghsa':323C 'ghsa-8g28-rj54-p5p2':322C 'guzmán':334C 'host':14A,36B,83B,223C,316C 'id':117C 'identifi':175C 'impact':237C 'import':125C 'includ':167C 'incorpor':273C 'independ':336C 'inject':8A,39B,92C,106C,181C 'instead':68B 'intend':226C 'interpret':197C 'isol':307C 'issu':182C,244C,342C 'lab':30B 'lab-disclosur':29B 'latest':261C 'least':302C 'least-privileg':301C 'let':9A,209C 'like':330C 'line':66B,202C 'local':164C 'make':55B 'mario':333C 'mcp':5A,32B,51B,53B,98C,112C,139C,149C,252C 'model':146C 'new':275C 'open':144C 'open-sourc':143C 'oper':44B,187C 'option':67B,203C 'outsid':84B,224C 'overwrit':76B,216C 'p5p2':326C 'pars':61B 'patch':271C 'pdt':134C 'pleas':349C 'privileg':303C 'process':348C 'protocol':148C 'public':128C 'publish':151C 'python':33B 'question':355C 'rather':204C 'reach':314C 'recommend':257C 'refer':58B,190C,318C 'repositori':157C,294C 'requir':126C 'research':337C 'resolut':242C 'revis':71B,207C 'rj54':325C 'run':163C,288C,296C 'scan':11A,43B,101C,115C,166C,170C,186C,195C,290C 'scope':121C 'secur':3A,49B,96C,110C,137C,165C,250C,354C 'security-agent-mcp-serv':2A,48B,95C,109C,136C,249C 'self':35B 'self-host':34B 'sensit':315C 'server':6A,52B,54B,99C,113C,140C,150C,231C,253C,298C 'sourc':145C,172C 'stray':311C 'suppli':192C 'thank':332C 'tool':27B 'truncat':78B,218C 'trust':293C 'type':124C 'upgrad':258C,284C,287C 'use':161C 'user':304C 'valu':59B,191C 'version':238C,254C,262C 'vulner':346C 'workaround':277C,281C 'workspac':86B,227C,234C 'workspace-confin':233C 'would':329C 'write':12A,312C 'yud4s':335C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the AWS security-agent-mcp-server MCP server so an AI assistant can run local diff scans over source code. Exposure depends on whether the scan reference value can be influenced by someone who is not trusted, and on the privileges the server process runs with. Teams on `0.2.0` or later, or not running this server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T18:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/#CVE-2026-97662","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","fetched_at":"2026-10-24T23:56:23+00:00","note":"AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan"},{"source":"nvd","external_id":"CVE-2026-97662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97662","severity":null,"published_at":"2026-10-01T18:17:29+00:00","modified_at":"2026-10-01T20:36:52+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97662","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97662","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2963,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/","title":"AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan","kind":"advisory","source":"lab","text":"CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\n### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\nBulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT\n\nDescription:\n\nsecurity-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential \"diff\" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.\n\nImpacted versions: >= 0.1.1 AND < 0.2.0\n\nResolution:\n\nThis issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.\n\nReferences:\n\n- CVE-2026-97662\n- GHSA-8g28-rj54-p5p2\n\nAcknowledgement:\n\nWe would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}