The vulnerability resides in the run_script Python sandbox of AWS MCP Server. An incomplete list of disallowed inputs in the code validator permits an authenticated remote user to craft a script that bypasses restrictions and executes arbitrary code inside their own isolated session environment. The attacker is confined to the session in which the script runs, so it does not broaden to system‑wide compromise. The weakness corresponds to CWE-184.

The issue affects all AWS MCP Server instances that use the run_script tool. No specific version range is provided; the problem applies to all current deployments until AWS delivers the service‑side fix.

The CVSS score is 5.3, indicating moderate severity. No EPSS score is available, so the likelihood of exploitation is unclear. The vulnerability is not listed in CISA KEV, and AWS has applied a service‑side fix, eliminating any need for customer‑side remediation. The attack vector is authenticated remote access within a user’s isolated environment.