CVE-2026-18953 is a high severity (CVSS 8.6) path traversal in the get_resource tool of awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4. The savePath parameter can write files outside the intended working directory. AWS fixed it in version 0.1.5, and no configuration workaround exists, so upgrade.
What's affected
AWS's security bulletin and the GitHub advisory GHSA-66mr-jr63-2jgw agree on the scope:
- Affected: awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4
- Fixed: 0.1.5 or later
The advisory states there is no server-side or configuration-only workaround, and the affected code path is present in the default configuration. The MCP server runs locally on a developer's machine. The bulletin also tells owners of forks or derivative code to make sure they include the fix. The GitHub score is 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), which matches the record. The record's phrase is a context-dependent actor, and the vector requires user interaction.
How to check if you're exposed
Check which version is installed in each Python environment:
pip show awslabs.aws-transform-mcp-server
If you launch the server through uvx or a similar runner, look at your MCP client configuration to see which version it requests and whether a cached copy is in use. A pinned version in that configuration is easy to forget.
To find it across repositories and machines, scan your dependency files with the free in-browser scan at gold.safeguard.sh/scan. It reports known CVEs for the packages it finds.
What to do now
- Find every machine and repository that runs awslabs.aws-transform-mcp-server.
- Upgrade to 0.1.5 or later, and update any pinned version in your MCP client configuration.
- If you maintain a fork or wrapper, merge the upstream fix.
- Review recently written files outside the project directory on machines that ran the affected versions.
- Treat the tool as having the file permissions of the developer account, and keep sensitive paths such as shell startup files protected.
- Re-scan to confirm no affected version remains.
Why it matters
The weakness class is CWE-22, path traversal. The get_resource tool accepts a savePath value from the caller and writes a file there. If the code does not confine that value to the working directory, relative path segments or absolute paths can send the write elsewhere on the file system, with the rights of the user who runs the server.
In an MCP setting, the caller is often an AI model whose inputs may be shaped by documents or tool results it has read. That is why the record says a context-dependent actor. Writing a file to a startup or configuration location can lead to code execution later, which explains the high impact ratings. The fix is to validate and confine paths on the server side. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a configuration workaround?
No. AWS and the GitHub advisory both say there is none and that the code path is present in the default configuration.
Which version do I need?
Version 0.1.5 or later of awslabs.aws-transform-mcp-server.
Sources
Last reviewed: 18 October 2026.
