CyberRota Analysis
AI-GeneratedThe get_resource tool in Amazon awslabs.aws-transform-mcp-server versions 0.1.0 to 0.1.4 is vulnerable due to improper pathname restrictions, allowing attackers to write arbitrary files outside the designated working directory through the savePath parameter. This could lead to unauthorized file access or manipulation, posing a significant risk to system integrity. Organizations using affected versions should prioritize upgrading to version 0.1.5 or later to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)