{"id":"CVE-2026-97662","published":"2026-10-01T18:17:29.230","lastModified":"2026-10-01T20:36:52.220","description":"An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation.\n\n\n\nTo remediate this issue, users should upgrade to version 0.2.0.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","cwes":["CWE-73","CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-121-aws/","tags":[]},{"url":"https://pypi.org/project/awslabs.security-agent-mcp-server/0.2.0/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows context-dependent threat actors to manipulate file operations outside the intended directory, potentially leading to arbitrary file creation, overwrite, or truncation.","exploitability":"Exploitation requires a crafted reference value supplied to the diff scan operation, making it moderately difficult. The attacker must have the ability to influence the input to the diff scan operation.","blast_radius":"If exploited, the impact could be severe, as it allows for arbitrary file manipulation on the host, potentially leading to data loss or system compromise.","remediation":"Upgrade to version 0.2.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["file-injection","arbitrary-file","upgrade"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:43:23.596Z"}}