Threats affecting pkg:pypi/awslabs-aws-serverless-mcp-server

CVE-2026-116635 is a relative path traversal vulnerability in the AWS Serverless MCP Server (aws-serverless-mcp-server) before version 0.2.1. It allows an attacker who can influence the MCP agent to read JSON files outside the intended deployment status directory and, if write access is enabled, to create or overwrite JSON files outside that directory. The vulnerability arises from improper limitation of pathname inputs, which can be exploited using directory traversal sequences or absolute paths in the project name input. AWS has released version 0.2.1 to address this issue.