CNNVD-202509-1056 Information
CNNVD ID
CNNVD-202509-1056
Related CVE
- CNNVD Published: 2025-09-08
Description (Chinese)
aws-mcp-server是Alexei Ledenev个人开发者的一个一种轻量级服务，使AI助手能够通过模型上下文协议（MCP）执行AWS CLI命令（在安全的容器化环境中）。 aws-mcp-server 0.0.13之前版本存在操作系统命令注入漏洞，该漏洞源于命令注入攻击。
Description (English)
Aws-mcp-server is a lightweight service of Alexei Ledenev’s personal developer, enabling AI’s assistants to implement AWS CLI orders (in a safe containerized environment) through model context agreements (MCP). Prior to version aws-mcp-server 0.013, there was an operational system command-injecting loophole, which originated from the order-injecting attack.
Hazard Level
Medium
Vulnerability Type
操作系统命令注入
Affected Vendor
个人开发者
Published
2025-09-08
Last Modified
2026-02-24
References
https://github.com/akoskm/create-mcp-server-stdio/commit/48c26bbe1f8c62764e4592f33c8300d1cadd2eac https://github.com/akoskm/create-mcp-server-stdio/blob/main/src/index.ts#L24-L40 https://github.com/akoskm/create-mcp-server-stdio/security/advisories/GHSA-3ch2-jxxc-v4xf https://access.redhat.com/security/cve/cve-2025-54994
Patch
https://github.com/akoskm/create-mcp-server-stdio/releases
Share on: