{"id":"CVE-2026-115845","published":"2026-10-23T19:17:44.643","lastModified":"2026-10-23T19:23:01.467","description":"An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.\n\n\n\nAWS fixed this issue service-side. No customer action is required.","cvssScore":6.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-149-aws/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}