What happened
The Python code validator that backs the AWS MCP Server run_script tool has an incomplete denylist that may allow an authenticated remote user to execute arbitrary code within their own isolated session environment. AWS fixed the issue service-side. CVSS 6.4 (v3.1), published 2026-10-23.
Why it matters
The code-execution tool of an agent MCP surface is a key jump point; while AWS confined the impact to the user's isolated session, it shows how code-validator denylists are a fragile boundary for LLM-driven script execution.
Attack vector
An incomplete list of disallowed inputs in the Python code validator of the run_script tool allows an authenticated remote user to run arbitrary code in their own isolated session via a crafted script (CWE-184).
Affected systems
AWS MCP Server (hosted) run_script tool
Mitigation
AWS fixed it service-side; no customer action required. For self-hosted deployments, review the run_script validator allow-/deny-list and treat script execution as untrusted.