A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_query method. The vulnerability stems from the exposure of dangerous Python built-in functions (__import__, getattr, hasattr) in the execution namespace and the direct use of exec() to execute user-supplied code. An attacker can craft malicious queries to execute arbitrary Python code, leading to AWS credential theft (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), file system access, environment variable disclosure, and potential system compromise. The vulnerability allows attackers to bypass intended security controls and gain unauthorized access to sensitive AWS resources and credentials stored in the server's environment.
References
| Link | Resource |
|---|---|
| https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8 | Exploit Third Party Advisory Issue Tracking |
Configurations
History
31 Dec 2025, 02:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Baryhuang aws Resources Mcp Server
Baryhuang |
|
| CPE | cpe:2.3:a:baryhuang:aws_resources_mcp_server:0.1.0:*:*:*:*:*:*:* | |
| References | () https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8 - Exploit, Third Party Advisory, Issue Tracking |
18 Nov 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
18 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-18 16:15
Updated : 2025-12-31 02:23
NVD link : CVE-2025-63604
Mitre link : CVE-2025-63604
CVE.ORG link : CVE-2025-63604
JSON object : View
Products Affected
baryhuang
- aws_resources_mcp_server
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')