CVE-2026-18953: aws transform mcp server from 0.1.0 (inclusive), before 0.1.5 (exclusive); +1 more affected products

Affected technology

aws transform mcp server · from 0.1.0 (inclusive), before 0.1.5 (exclusive)
amazon

aws-transform-mcp-server · 0.1.0 through 0.1.4
AWS

Description’s affected range: through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.