Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might… (CVE-2026-85654)

The CDK generator component in Amazon awslabs.dynamodb-mcp-server versions prior to 2.1.6 suffers from improper neutralization of special elements in its template engine. This weakness (CWE-1336) can be exploited by an attacker who crafts malicious table, index, or attribute names within a data model file, potentially leading to arbitrary code execution on the host system that deploys the generated application. The vulnerability is context-dependent and requires user interaction but no privileges. It is tracked as CVE-2026-85654 with a CVSS 3.1 score of 7.8.

Successful exploitation could allow an attacker to execute arbitrary code on the host machine deploying the affected application, potentially compromising confidentiality, integrity, and availability of the system. The attack requires user interaction but no prior privileges, making it a significant risk in environments where untrusted data model files might be processed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor vendor communications for updates and avoid processing untrusted data model files until a fix is available.