Improper Directory Limitation in Amazon awslabs.aws-transform-mcp-server Tool
CVE-2026-18953

6.3MEDIUM

Key Information:

Vendor

Aws

Status
Aws-transform-mcp-server
Vendor
CVE Published:
5 August 2026

What is CVE-2026-18953?

The awslabs.aws-transform-mcp-server tool from Amazon contains a vulnerability due to improper validation of the savePath parameter, which could allow an attacker to write files outside the designated working directory. This issue affects versions 0.1.0 through 0.1.4. Users are encouraged to upgrade to version 0.1.5 or later to address this security risk effectively.

Affected Version(s)

aws-transform-mcp-server 0.1.0 <= 0.1.4

References

https://pypi.org/project/awslabs.aws-transform-mcp-server...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/awslabs/mcp/security/advisories/GHSA-6...
release-notes

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.