AWS Agent Plugins EUVD-2026-95151

Requires the vulnerable databases-on-aws plugin (before 1.7.1) installed and active, and the operator to invoke the psql-connect.sh helper's --command path so that attacker-controlled input reaches 'psql -c' (UI:P, AV:L). The specific prerequisite is an attacker-influenced 'database command value' in the agent context containing a psql backslash meta-command (e.g., '\!', '\copy', '\i', '\o'); the pre-1.7.1 filter rejected multiple statements and comment injection but did NOT reject backslash-dispatched meta-commands, which is the gap. Limiting factors: exploitation is local to the agent host and depends on operator interaction (the agent actually running the database command), so it is not a default-config remote-network compromise; only environments where this plugin is deployed and active are affected.

The CVSS 4.0 base score of 8.5 (High) is driven by full compromise of the local host (VC:H/VI:H/VA:H) via arbitrary OS command execution, but the attack vector is AV:L (local) with UI:P (passive user interaction required), not a network-facing flaw. This creates an apparent conflict with the description, which calls the actor 'remote unauthenticated': the reconciliation is that the psql helper executes locally on the agent host, while the malicious payload can originate remotely as attacker-influenced database content/agent context that the AI agent later processes - verify this interpretation against the AWS bulletin before treating it as a classic remote RCE. Exploitation realistically requires the agent operator to invoke the database-command path (UI:P), which materially lowers real-world risk versus a true AV:N/PR:N/UI:N bug. No EPSS score, no CISA KEV listing, and no public exploit were provided, and no SSVC decision data is available; given the niche footprint and the required operator interaction, this is a credible but not mass-exploitation-urgent priority - patch promptly where the plugin is deployed, but it is not comparable to a wormable internet-facing CVSS 8.5. Note also the input 'Information Disclosure' tag is inconsistent with the actual command-execution impact.

An attacker places a crafted database command value - such as a psql meta-command like '\! <shell command>' - into data that an AI agent ingests into its context (e.g., attacker-controlled rows or prompt-injected content). When the operator's agent runs the databases-on-aws psql-connect.sh helper, the incomplete input filter (which blocked semicolons and SQL comments but not backslash meta-commands) passes the value to 'psql -c', and psql dispatches '\!' to a local shell, executing arbitrary OS commands on the host. No public exploit was identified, though the patch commit publicly reveals the vector; the local vector and required operator interaction constrain practical exploitation.