This vulnerability in aws-mcp-server involves a command injection flaw due to insufficient validation of user input before executing system calls. Remote attackers can exploit this to run arbitrary code without authentication. The Zero Day Initiative assigned a CVSS score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor has not issued a patch and has rejected the report. The advisory recommends restricting interaction with the product as the primary mitigation.

Successful exploitation allows remote attackers to execute arbitrary code on the aws-mcp-server with no authentication required. This can lead to full compromise of the affected system, including complete loss of confidentiality, integrity, and availability. Given the critical CVSS score and unauthenticated remote exploitability, the impact is severe.

No official patch or fix is available as the vendor has rejected the vulnerability report. The advisory recommends restricting interaction with the aws-mcp-server product to mitigate risk. Organizations should consider isolating or disabling the affected service until a vendor fix or alternative mitigation is provided. Monitor vendor communications for any updates.