Skip to content
OpenAdvisories
Critical · 9.6 CVE-2025-5277 EUVD-2025-16320

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run …

Published May 28, 2025 · Updated May 28, 2025 · Assigned by snyk

Vendor: alexei-led Product: aws-mcp-server

Description

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system.

Affected products

VendorProductAffectedFixed
alexei-led aws-mcp-server < 1.3.0 1.3.0

References