Awslabs Dynamodb Mcp Server
Monthly
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.