---
id: "CVE-2026-97662"
kind: "vulnerability"
aliases: ["CVE-2026-97662"]
title: "AWS security-agent-mcp-server: argument injection lets diff scans write arbitrary host files"
severity: "high"
cvss: 8.2
epss: 0.00142
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-assistants", "ai-tooling", "aws", "lab-disclosure", "mcp", "python", "self-hosted"]
not_affected_if: ["not-using-mcp-server", "patched-version"]
published_at: "2026-10-01T18:17:29+00:00"
first_seen_at: "2026-10-24T19:43:43+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/", "first_seen_at": "2026-10-24T19:43:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97662", "first_seen_at": "2026-10-24T20:15:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97662", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# AWS security-agent-mcp-server: argument injection lets diff scans write arbitrary host files

An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server makes a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite or truncate arbitrary files on the host outside the workspace directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.
- Look for the package in MCP client configs and lockfiles, and check the pinned version.

## Fix

- Upgrade security-agent-mcp-server to `0.2.0` or later.
- Patch any forked or derivative code with the upstream fix.
- Until upgraded, run diff scans only against trusted repositories and run the server as a least-privileged user in an isolated environment.

## Timeline

- 2026-10-24T19:43:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/ — AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan
- 2026-10-24T20:15:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97662
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97662

## Documents

- [advisory] AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/

## From the sources

CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

Bulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT

Description:

security-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential "diff" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.

Impacted versions: >= 0.1.1 AND < 0.2.0

Resolution:

This issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.

References:

- CVE-2026-97662
- GHSA-8g28-rj54-p5p2

Acknowledgement:

We would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns..

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_