CVE-2026-97662

HighCVSS 8.2/10Last modified Oct 1, 2026

Description

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan operation.

To remediate this issue, users should upgrade to version 0.2.0.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-73 CWE-88

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-976637.2The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versio CVE-2026-976657.1A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and br CVE-2026-976666.9Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call throu CVE-2026-976675.1Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the met CVE-2026-976689.8The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all v CVE-2026-97676.5The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Paramet CVE-2026-976709.1The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is CVE-2026-976716.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vu CVE-2026-976738.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation CVE-2026-976748.1IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutraliz CVE-2026-976768.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization o CVE-2026-976788.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation