CVE-2026-18953 in aws-transform-mcp-server
要約
〜によって MITRE • 2026年08月05日
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter.
To remediate this issue, users should upgrade to version 0.1.5 or later.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.