AWS security-agent-mcp-server parameter injection vulnerability CVE-2026-97662
Start here
On October 1, AWS published security advisory 2026-121-AWS, disclosing the parameter injection vulnerability CVE-2026-97662 in security-agent-mcp-server. Affected versions are from 0.1.1 up to but not including 0.2.0, with a CVSS 3.1 score of 8.2. The diff-scan tool does not sufficiently validate the baseline reference parameter, which may cause input to be misparsed as Git command options, bypassing workspace restrictions and causing file creation or overwrite. AWS recommends upgrading to 0.2.0 or later and explicitly restricting the workspace.
Generated by AI from reports · Updated 5 days ago
Progress timeline
- Date not givenal-ice.aiAWS security-agent-mcp-server fixes diff scan parameter injection vulnerability CVE-2026-97662
On October 1, AWS published security advisory 2026-121-AWS, disclosing the parameter injection vulnerability CVE-2026-97662 in security-agent-mcp-server. Affected versions are from 0.1.1 up to but not including 0.2.0, with a CVSS 3.1 score of 8.2. The diff-scan tool does not sufficiently validate the baseline reference parameter, which may cause input to be misparsed as Git command options, bypassing workspace restrictions and causing file creation or overwrite. AWS recommends upgrading to 0.2.0 or later, explicitly restricting the workspace, and running the service with a non-privileged user.
Related discussion
Attention trend
New sources per day
- Oct 5: 1 new sources (1 outlets, 0 accounts)
- Oct 6: 0 new sources (0 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)