Amazon Agent Plugins databases-on-aws: OS command injection
Summary
The databases-on-aws plugin in Amazon Agent Plugins for AWS does not fully filter disallowed inputs in the psql helper command path. An attacker who gets crafted content into an AI coding agent's context can cause the agent to run the local helper with a malicious database command value, which executes arbitrary operating system commands with the permissions of the helper process. The affected code is not a listening network service, so exposure is mainly on hosts where the agent and plugin run. NVD rates the issue CVSS 4.0 8.5 (High) and the status was Awaiting Analysis at the time of review.
Affected
- databases-on-aws plugin versions 1.0.0 through 1.7.0 (Amazon Agent Plugins for AWS)
- Forks and derivative code that do not include the fix
Fixed in
- databases-on-aws 1.7.1 or later (available from the marketplace since 26 Aug 2026)
- Pinned repository revisions: commit 8b13a503746a4ebb0402b936645163224058bde3 or later
Workaround
- Avoid the optional psql connection helper command path and use only manually reviewed SQL, or use the DSQL MCP server instead of the helper
- Run the agent and helper as an unprivileged OS user with a dedicated IAM role limited to dsql:DbConnect and a scoped, preferably read-only database role
- Do not use admin roles or grant dsql:DbConnectAdmin for routine agent operations
- These measures reduce impact but do not fix the flaw
Exploitation
- No public proof of concept found
- No evidence of exploitation in the wild in the reviewed sources; CISA KEV not verified
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Inventory all workstations, repositories and CI environments with the databases-on-aws plugin, including forks
- Upgrade to 1.7.1 or later and confirm the updated plugin is active
- Until patched, restrict agent database access to least privilege as described above
- Re-check NVD and CISA KEV for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-130-AWS aws.amazon.com
- Fix commit 8b13a50 (awslabs/agent-plugins) github.com
- Pull request #232 (awslabs/agent-plugins) github.com
- OSV entry CVE-2026-107322 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:07.
Original description (NVD)
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.