Popis
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later.
CVSS 8.6EPSS 0.14300000000000002%Riziko 0.87
Zobraziť zdroj- Zverejnené
- 2026-08-05 20:17:07
- Posledná úprava
- 2026-08-10 13:12:47
- Vektor
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H