{"data":{"id":"af5ce664-25db-4e45-bc54-f52988629e87","title":"CVE-2026-18953 - Improper limitation of a pathname in AWS Transform MCP Server","summary":"A vulnerability exists in AWS Transform MCP Server (a tool that lets AI assistants run code-transformation jobs on a developer's local machine) versions 0.1.0 through 0.1.4. An attacker could exploit improper pathname validation in the get_resource tool to write files anywhere on the system outside the intended directory, potentially leading to local code execution (unauthorized commands running on the developer's computer).","solution":"Update awslabs.aws-transform-mcp-server to version 0.1.5 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-075-aws/","publishedAt":"2026-08-05T20:46:20.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS","awslabs.aws-transform-mcp-server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-08-05T20:46:20.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}