GHSA-fc67-c4hg-q653: Github.com/aws/amazon ecs agent Amazon ECS Container Agent (Windows) Vulnerability

HIGH
Share
CVSS 7.2
CWE-78
Published
Advisory Summary

GHSA-fc67-c4hg-q653 is a HIGH (CVSS 7.2) amazon ecs container agent (windows) vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) affecting Github.com/aws/amazon ecs agent libraries in the Go ecosystem. The issue involves amazon ecs container agent (windows) is vulnerable to information disclosure. Remediation is available by upgrading affected packages to version 1.103.0.

GHSA-fc67-c4hg-q653 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-fc67-c4hg-q653
Severity HIGH
CVSS v3.1 Base Score 7.2
CWE Classification CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Product Github.com/aws/amazon ecs agent
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 7.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required High (PR:H)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix GHSA-fc67-c4hg-q653

To remediate this vulnerability, upgrade all affected Github.com/aws/amazon ecs agent dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/aws/amazon-ecs-agent fixed: 1.103.0 
Upgrade github.com/aws/amazon-ecs-agent to 1.103.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/aws/amazon-ecs-agent

How to Check if You Are Affected

To determine whether your application is affected by GHSA-fc67-c4hg-q653, inspect your project dependencies for Github.com/aws/amazon ecs agent:

inspect dependencies for github.com/aws/amazon-ecs-agent

Analyze the terminal output to locate any version of Github.com/aws/amazon ecs agent in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.103.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), where the product constructs all or part of an os command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended os command when it is sent to a downstream component. In Github.com/aws/amazon ecs agent, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary [Amazon Elastic Container Service (Amazon ECS)](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volume mounting process allows command injection through specially crafted credentials. ### Impact Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username field in an ECS task definition. This issue requires permissions to register ECS task definitions or write to the Secrets Manager or SSM Parameter Store credentials used by the FSx volume configuration. To remediate this issue, users should upgrade to version 1.103.0. **Impacted versions**: Version 1.47.0 through 1.102.2 of the ECS Agent for Windows ### Patches This issue only impacts ECS Windows worker instances. ECS on Fargate is not affected. This issue has been addressed in ECS agent version 1.103.0. Amazon ECS recommends [upgrading](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_window-container_instance.html) to the [latest](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-windows-ami-versions.html) Amazon ECS-optimized Windows AMI with an updated ECS agent version. ### Workarounds Customers who cannot update to the latest AMI can restrict ecs:RegisterTaskDefinition permissions to trusted IAM principals only and restrict write access to Secrets Manager secrets referenced in FSx volume configurations. ### References If you have any questions or comments about this advisory, Amazon ECS asks that users contact [AWS/Amazon] Security via [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. ### Acknowledgement Amazon ECS would like to thank Sachin Patil for collaborating on this issue through the coordinated vulnerability disclosure process.

GHSA-fc67-c4hg-q653 Affected Github.com/aws/amazon ecs agent Versions

1 component(s)
Fixed Versions:
1.103.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/aws/amazon-ecs-agent
golang/github.com/aws/amazon-ecs-agent
Go
≥ 1.47.0
< 1.103.0
1.103.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-fc67-c4hg-q653
Github.com/aws/amazon ecs agent Source Repository REPOSITORY
https://github.com/aws/amazon-ecs-agent

Frequently Asked Questions

What is GHSA-fc67-c4hg-q653?
GHSA-fc67-c4hg-q653 is a security vulnerability in Github.com/aws/amazon ecs agent involving Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
Which Github.com/aws/amazon ecs agent versions are affected?
Affected versions include releases prior to 1.103.0 across affected packages: github.com/aws/amazon-ecs-agent.
What version fixes GHSA-fc67-c4hg-q653?
Upgrading to 1.103.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/aws/amazon-ecs-agent affected?
Yes, github.com/aws/amazon-ecs-agent is affected in releases prior to 1.103.0. Upgrade your dependency to 1.103.0 or later.
What is the CVSS score of GHSA-fc67-c4hg-q653?
GHSA-fc67-c4hg-q653 has a CVSS v3.1 base score of 7.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with GHSA-fc67-c4hg-q653?
GHSA-fc67-c4hg-q653 is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.).
How can I check Go dependencies for GHSA-fc67-c4hg-q653?
Run the dependency tree command: 'inspect dependencies for github.com/aws/amazon-ecs-agent'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fc67-c4hg-q653",
  "modified" : "2026-05-07T01:22:45Z",
  "published" : "2026-05-07T01:22:45Z",
  "aliases" : [ ],
  "summary" : "Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure",
  "details" : "### Summary\n[Amazon Elastic Container Service (Amazon ECS)](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volume mounting process allows command injection through specially crafted credentials. \n\n### Impact\nImproper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username field in an ECS task definition. This issue requires permissions to register ECS task definitions or write to the Secrets Manager or SSM Parameter Store credentials used by the FSx volume configuration.\n\n\nTo remediate this issue, users should upgrade to version 1.103.0.\n\n**Impacted versions**: Version 1.47.0 through 1.102.2 of the ECS Agent for Windows\n\n### Patches\nThis issue only impacts ECS Windows worker instances. ECS on Fargate is not affected. This issue has been addressed in ECS agent version 1.103.0.  Amazon ECS recommends [upgrading](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_window-container_instance.html) to the [latest](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-windows-ami-versions.html) Amazon ECS-optimized Windows AMI with an updated ECS agent version.\n\n### Workarounds\nCustomers who cannot update to the latest AMI can restrict ecs:RegisterTaskDefinition permissions to trusted IAM principals only and restrict write access to Secrets Manager secrets referenced in FSx volume configurations.\n\n### References\nIf you have any questions or comments about this advisory, Amazon ECS asks that users contact [AWS/Amazon] Security via [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n### Acknowledgement\n\nAmazon ECS would like to thank Sachin Patil for collaborating on this issue through the coordinated vulnerability disclosure process.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/aws/amazon-ecs-agent"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.47.0"
      }, {
        "fixed" : "1.103.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.102.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-fc67-c4hg-q653"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/aws/amazon-ecs-agent"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-07T01:22:45Z",
    "nvd_published_at" : null
  }
}