aws-mcp-server Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in aws-mcp-server. This issue arises from improper validation of user-supplied strings in the allowed commands list, which can be exploited to execute arbitrary code on the server running aws-mcp-server. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected server, with the executed code running in the context of the MCP server.