{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-97662",
    "name": "CVE-2026-97662",
    "vendor": "awslabs.security-agent-mcp-server",
    "description": "AWS Security Bulletin 2026-121-AWS (1 October 2026, with GHSA-8g28-rj54-p5p2; NVD published the same day) covers an argument injection in awslabs.security-agent-mcp-server, the MCP server in the awslabs/mcp repository that lets AI assistants run AWS Security Agent scans over local source code. The diff scan operation passed a caller-influenced base reference into git so that a value starting with a dash was read as a command-line option rather than a revision, and the server's workspace-confinement check did not cover that argument. An actor who can influence the reference, for example through content in the repository being scanned, can create, overwrite or truncate any file the server process can write, including shell startup files, SSH authorized_keys and credential files, with content partly controlled by the scanned repository, which can lead to code execution. The operation reports that no diff was found, so the write leaves no signal for the operator. AWS scores it CVSS 3.1 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H) and CVSS 4.0 6.9. The fix rejects empty or dash-prefixed refs; it shipped in 0.2.0 on PyPI on 26 August, five weeks before the bulletin. Credited to Mario Guzman (yud4s).",
    "website": "https://aws.amazon.com/security/security-bulletins/2026-121-aws/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "awslabs.security-agent-mcp-server",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-01",
    "risk": {
      "score": 82,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-97662",
      "aliases": [
        "ti-114",
        "GHSA-8g28-rj54-p5p2"
      ],
      "title": "CVE-2026-97662: A Crafted Git Ref Turns the AWS Security Agent MCP Server's Diff Scan Into a File Write Outside the Workspace (CVSS 8.2)",
      "summary": "AWS Security Bulletin 2026-121-AWS (1 October 2026, with GHSA-8g28-rj54-p5p2; NVD published the same day) covers an argument injection in awslabs.security-agent-mcp-server, the MCP server in the awslabs/mcp repository that lets AI assistants run AWS Security Agent scans over local source code. The diff scan operation passed a caller-influenced base reference into git so that a value starting with a dash was read as a command-line option rather than a revision, and the server's workspace-confinement check did not cover that argument. An actor who can influence the reference, for example through content in the repository being scanned, can create, overwrite or truncate any file the server process can write, including shell startup files, SSH authorized_keys and credential files, with content partly controlled by the scanned repository, which can lead to code execution. The operation reports that no diff was found, so the write leaves no signal for the operator. AWS scores it CVSS 3.1 8.2 (AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H) and CVSS 4.0 6.9. The fix rejects empty or dash-prefixed refs; it shipped in 0.2.0 on PyPI on 26 August, five weeks before the bulletin. Credited to Mario Guzman (yud4s).",
      "severity": "high",
      "cvss": {
        "score": 8.2,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "awslabs.security-agent-mcp-server",
        "vendor": null,
        "package": "awslabs.security-agent-mcp-server",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": ">=0.1.1 <0.2.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-01",
      "modifiedAt": "2026-10-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://aws.amazon.com/security/security-bulletins/2026-121-aws/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97662"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-8g28-rj54-p5p2"
        }
      ],
      "mitigation": "Upgrade awslabs.security-agent-mcp-server to 0.2.0 or later, and check `uvx`/`pipx` caches and pinned MCP configs, which can keep launching an old version after the package is updated. AWS lists no workaround: until upgraded, run diff scans only on trusted repositories and run the server as a low-privilege user in an isolated environment. Because the vulnerable write produces no error, hosts that diff-scanned untrusted repositories on an affected version should have ~/.bashrc, ~/.zshrc, ~/.profile, ~/.ssh/authorized_keys and credential files checked for unexpected changes. Patch forks and derivative code that copied the diff-scan handler.",
      "detectedByAnomity": true
    }
  }
}