aws-transform-mcp-server vulnerabilities

Latest aws-transform-mcp-server CVEs

Newest publication first

1. CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

   Published 2026-08-05

   Medium·CVSS 6.3 EPSS 0.18%

   Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.