CVE-2026-115845

The record

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.

Affected packages

Related vulnerabilities

• CVE-2026-119567 vsftpd through 3.0.5 contains an access control bypass vulnerability that allows… CWE-184
• CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an… CWE-184
• CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete… CWE-184
• CVE-2026-115751 Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request… CWE-184
• CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-184
• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a… CWE-184