Skip to main content

Awslabs Dynamodb Mcp Server

1 CVEs product

Monthly

CVE-2026-85654 Sep 04, 17:05 HIGH PATCH This Week

Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.

RCE Ssti Amazon Awslabs Dynamodb Mcp Server
NVD
CVSS 4.0
7.1
EPSS
0.1%
EPSS 0% CVSS 7.1
HIGH PATCH This Week

Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.

RCE Ssti Amazon +1
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy