AWS security-agent-mcp-server fixes diff scan parameter injection vulnerability CVE-2026-97662

On October 1, AWS published security advisory 2026-121-AWS, disclosing the parameter injection vulnerability CVE-2026-97662 in security-agent-mcp-server. Affected versions are from 0.1.1 up to but not including 0.2.0, with a CVSS 3.1 score of 8.2. The diff-scan tool does not sufficiently validate the baseline reference parameter, which may cause input to be misparsed as Git command options, bypassing workspace restrictions and causing file creation or overwrite. AWS recommends upgrading to 0.2.0 or later, explicitly restricting the workspace, and running the service with a non-privileged user.