CVE-2026-85654: Amazon Awslabs.dynamodb-Mcp-Server

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

Affected products

• Amazon Awslabs.dynamodb-Mcp-Server: from 2.0.10, up to and including 2.1.5

Published 2026-09-04. Last modified 2026-09-08.