Aws Serverless Mcp Server
Monthly
Path traversal in the AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server) before v0.2.1 allows an actor who can influence the MCP agent's serverless project-name input to read the contents of JSON files outside the intended deployment status directory, because the deployment status component does not confine the resolved pathname to that directory. When the server is additionally run with the non-default --enable-write flag, the same input can create or overwrite JSON files outside the directory, clobbering existing files with serverless deployment metadata. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) reflects no privileges required but mandatory interaction, and no public exploit was identified at time of analysis; the vendor states there is no workaround and that upgrading to v0.2.1 is the fix.
Path traversal in the AWS Serverless MCP Server (awslabs.aws-serverless-mcp-server) before v0.2.1 allows an actor who can influence the MCP agent's serverless project-name input to read the contents of JSON files outside the intended deployment status directory, because the deployment status component does not confine the resolved pathname to that directory. When the server is additionally run with the non-default --enable-write flag, the same input can create or overwrite JSON files outside the directory, clobbering existing files with serverless deployment metadata. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) reflects no privileges required but mandatory interaction, and no public exploit was identified at time of analysis; the vendor states there is no workaround and that upgrading to v0.2.1 is the fix.