Which versions of aws-transform-mcp-server are affected by CVE-2026-18953?

Amazon's aws-transform-mcp-server (versions 0.1.0-0.1.4) contains a path traversal vulnerability enabling attackers to write arbitrary files to the filesystem.. A patch is available.

How to fix or mitigate CVE-2026-18953?

Within 24 hours, inventory all systems running aws-transform-mcp-server versions 0.1.0-0.1.4. Within 7 days, upgrade all instances to version 0.1.5 available via PyPI, validating successful deployment across your environment. Within 30 days, review system logs for suspicious file-write activity outside the intended working directory during the vulnerability window and perform filesystem integrity verification on patched systems.

aws-transform-mcp-server CVE-2026-18953

Q: What is the CVSS score of CVE-2026-18953?

CVE-2026-18953 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-53583 MEDIUM

Path Traversal (CWE-22)

2026-08-05 AMZN

Path Traversal AWS Aws Transform Mcp Server

6.3

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

6.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Local vector confirmed by MCP server deployment model; PR:N because no authentication to the MCP server is required; UI:R because tool invocation requires user or AI-model interaction; S:C for filesystem writes beyond working directory.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Aug 05, 2026 - 20:22 NVD

8.6 (HIGH) 6.3 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 20:18 vuln.today

CVE Published

Aug 05, 2026 - 19:33 cve.org

HIGH 8.6

DescriptionCVE.org

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter.

To remediate this issue, users should upgrade to version 0.1.5 or later.

AnalysisAI

Path traversal in Amazon's awslabs.aws-transform-mcp-server MCP package (versions 0.1.0-0.1.4) enables a context-dependent actor - which may include a malicious MCP resource, prompt-injected content, or local attacker - to write arbitrary files outside the server's intended working directory by supplying traversal sequences in the savePath parameter of the get_resource tool. The vulnerability carries a CVSS 8.6 (High) score with scope change, meaning exploitation can impact the broader local filesystem beyond the MCP server process itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch (version 0.1.5) is available via PyPI and covered under AWS Security Bulletin 2026-075.

Technical ContextAI

The affected component is the get_resource tool within the awslabs.aws-transform-mcp-server Python package (CPE: cpe:2.3:a:aws:aws-transform-mcp-server:*:*:*:*:*:*:*:*), an MCP (Model Context Protocol) server used to facilitate AI-assisted AWS infrastructure transformation workflows. MCP servers expose tool APIs invokable by AI models or users; the get_resource tool accepts a savePath parameter for writing retrieved resource content to disk. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Path Traversal) indicates the server fails to canonicalize or sanitize the savePath value before performing file write operations, allowing sequences such as '../../../etc/cron.d/backdoor' to resolve to locations outside the designated working directory. The 'context-dependent actor' phrasing is significant in the MCP threat model: exploitation may occur via prompt injection, where malicious content in a fetched resource causes the LLM to invoke get_resource with a crafted savePath, without the user's explicit knowledge.

RemediationAI

Upgrade awslabs.aws-transform-mcp-server to version 0.1.5 or later, available at https://pypi.org/project/awslabs.aws-transform-mcp-server/0.1.5/. The AWS Security Bulletin covering this issue is published at https://aws.amazon.com/security/security-bulletins/2026-075-aws/. If an immediate upgrade is not possible, a compensating control is to restrict the filesystem permissions of the user account running the MCP server so it can only write to an explicitly-bounded directory (e.g., using a chroot jail or container with a read-only root filesystem and a single writable mount). Additionally, auditing MCP tool invocations via server-side logging and alerting on savePath values containing '..' sequences can detect exploitation attempts. Note that these compensating controls do not fix the underlying validation flaw and should be treated as temporary measures only.