CVE-2026-97662: Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-73

Description

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation. To remediate this issue, users should upgrade to version 0.2.0.

Affected products

AWS security-agent-mcp-server: from 0.1.1 before 0.2.0 — fixed in 0.2.0

How to fix

Upgrade to a fixed version: AWS security-agent-mcp-server 0.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-97662 or the next vulnerability affects your stack