Deriv

**Name of the Vulnerable Software and Affected Versions** aws-healthomics-mcp-server versions prior to 0.0.36 **Description** Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server allows an actor who can influence the MCP agent to write controlled content to arbitrary locations outside the intended workflow bundle directory. This is achieved through directory traversal sequences in the `workflow files` input. Directory traversal is a technique that uses special characters to access files and directories that are stored outside the web root folder. **Recommendations** Upgrade to version 0.0.36 or later.