{"id":"GHSA-8g28-rj54-p5p2","kind":"vulnerability","aliases":["GHSA-8g28-rj54-p5p2"],"related":[],"title":"CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan","description":"CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\n### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\nBulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT\n\nDescription:\n\nsecurity-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential \"diff\" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.\n\nImpacted versions: >= 0.1.1 AND < 0.2.0\n\nResolution:\n\nThis issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.\n\nReferences:\n\n- CVE-2026-97662\n- GHSA-8g28-rj54-p5p2\n\nAcknowledgement:\n\nWe would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","summary":"An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server lets a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite, or truncate arbitrary files on the host outside the intended workspace.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-assistants","ai-tooling","aws","lab-disclosure","mcp","security-agent-mcp-server","self-hosted"],"not_affected_if":["not-running-mcp-server","version-0.2.0-or-later"],"how_to_check":"- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.\n- Find where the server runs and whether it accepts diff scan requests from untrusted input.","fix":"- Upgrade security-agent-mcp-server to `0.2.0` or later.\n- Patch any forked or derivative code with the fixes included in `0.2.0`.\n- Until upgraded, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment.","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","triaged_at":"2026-10-25T04:50:13+00:00","updated_at":"2026-10-25T04:50:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:50:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade security-agent-mcp-server to `0.2.0` or later.\n- Patch any forked or derivative code with the fixes included in `0.2.0`.\n- Until upgraded, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment.","reach":"unknown","title":"AWS security-agent-mcp-server: argument injection lets diff scans write arbitrary host files","impact":"high","summary":"An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server lets a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite, or truncate arbitrary files on the host outside the intended workspace.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","aws","security-agent-mcp-server","ai-assistants","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker overwrites or truncates arbitrary host files outside the workspace","analyst_note":"Confirm whether the reference value can come from untrusted input through an AI assistant, and whether the attack needs authentication, at https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/.","how_to_check":"- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.\n- Find where the server runs and whether it accepts diff scan requests from untrusted input.","needs_analyst":true,"not_affected_if":["version-0.2.0-or-later","not-running-mcp-server"],"who_is_affected":"Teams running security-agent-mcp-server between versions 0.1.1 and 0.2.0, especially where AI assistants can trigger diff scans over repositories they do not fully trust. Exposure depends on who can supply the reference value to the diff scan. Teams on 0.2.0 or later, or not running this MCP server, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":3904,"output_tokens":724,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121':126C '-2026':2A,96C,110C,184C,327C '-97662':3A,97C,111C,185C,328C '..':365C '0.1.1':246C '0.2.0':248C,262C '10':138C '10/01/2026':137C '2026':125C '30':139C '8g28':17A,22A,331C 'acknowledg':334C 'actor':221C 'address':254C 'agent':10A,38B,57B,104C,118C,145C,258C 'ai':26B,29B,166C 'ai-assist':25B 'ai-tool':28B 'arbitrari':86B,226C 'argument':4A,45B,98C,112C,187C 'assist':27B,167C 'attack':80B 'attent':134C 'aw':7A,31B,53B,101C,115C,127C,129C,160C 'aws-security@amazon.com':358C 'awslabs/mcp':163C 'bulletin':123C 'bypass':236C 'cannot':320C 'code':180C,276C 'collabor':346C 'command':72B,208C 'command-lin':71B,207C 'concern':364C 'confin':242C 'content':130C 'context':154C,219C 'context-depend':218C 'control':243C 'coordin':352C 'craft':64B,196C 'creat':82B,222C 'cve':1A,95C,109C,183C,326C 'date':136C 'depend':220C 'deriv':275C 'descript':142C 'diff':13A,49B,107C,121C,176C,192C,296C 'differenti':175C 'directori':235C 'disclosur':34B,354C 'email':357C 'ensur':271C 'environ':315C 'file':87B,227C,324C 'fix':283C 'fork':273C 'ghsa':16A,21A,330C 'ghsa-8g28-rj54-p5p2':15A,20A,329C 'guzmán':341C 'host':43B,90B,230C,323C 'id':124C 'identifi':182C 'impact':244C 'import':132C 'includ':174C 'incorpor':280C 'independ':343C 'inject':5A,46B,99C,113C,188C 'instead':75B 'intend':93B,233C 'interpret':204C 'isol':314C 'issu':189C,251C,349C 'lab':33B 'lab-disclosur':32B 'latest':268C 'least':309C 'least-privileg':308C 'let':62B,216C 'like':337C 'line':73B,209C 'local':171C 'mario':340C 'mcp':11A,35B,39B,58B,60B,105C,119C,146C,156C,259C 'model':153C 'new':282C 'open':151C 'open-sourc':150C 'oper':51B,194C 'option':74B,210C 'outsid':91B,231C 'overwrit':83B,223C 'p5p2':19A,24A,333C 'pars':68B 'patch':278C 'pdt':141C 'pleas':356C 'privileg':310C 'process':355C 'protocol':155C 'public':135C 'publish':158C 'question':362C 'rather':211C 'reach':321C 'recommend':264C 'refer':65B,197C,325C 'repositori':164C,301C 'requir':133C 'research':344C 'resolut':249C 'revis':78B,214C 'rj54':18A,23A,332C 'run':170C,295C,303C 'scan':14A,50B,108C,122C,173C,177C,193C,202C,297C 'scope':128C 'secur':9A,37B,56B,103C,117C,144C,172C,257C,361C 'security-agent-mcp-serv':8A,36B,55B,102C,116C,143C,256C 'self':42B 'self-host':41B 'sensit':322C 'server':12A,40B,59B,61B,106C,120C,147C,157C,238C,260C,305C 'sourc':152C,179C 'stray':318C 'suppli':199C 'thank':339C 'tool':30B 'truncat':85B,225C 'trust':300C 'type':131C 'upgrad':265C,291C,294C 'use':168C 'user':311C 'valu':66B,198C 'version':245C,261C,269C 'vulner':353C 'workaround':284C,288C 'workspac':94B,234C,241C 'workspace-confin':240C 'would':336C 'write':319C 'yud4s':342C","nicknames":[],"mitigations":[],"who_affected":"Teams running security-agent-mcp-server between versions 0.1.1 and 0.2.0, especially where AI assistants can trigger diff scans over repositories they do not fully trust. Exposure depends on who can supply the reference value to the diff scan. Teams on 0.2.0 or later, or not running this MCP server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/#GHSA-8g28-rj54-p5p2","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","fetched_at":"2026-10-24T23:56:23+00:00","note":"AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan"}],"documents":[{"id":2963,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/","title":"AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan","kind":"advisory","source":"lab","text":"CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\n### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan\n\nBulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT\n\nDescription:\n\nsecurity-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential \"diff\" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.\n\nImpacted versions: >= 0.1.1 AND < 0.2.0\n\nResolution:\n\nThis issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.\n\nReferences:\n\n- CVE-2026-97662\n- GHSA-8g28-rj54-p5p2\n\nAcknowledgement:\n\nWe would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}