CVE-2026-85654

Improper neutralization of special elements in the template engine of the CDK generator in Amazon's awslabs.dynamodb-mcp-server allows template injection through table, index, or attribute names defined in a data model file (CWE-1336). A context-dependent actor — for example an AI agent or untrusted data source able to influence that data model file — can craft these names so that executable code is embedded into the generated CDK project. When the generated application is deployed, the injected code executes on the host performing the deployment, giving the attacker arbitrary code execution in that local context. Only users running awslabs.dynamodb-mcp-server versions before 2.1.6 who generate and deploy CDK applications from data model files are affected; the flaw requires local generation/deployment activity, not exposure of a network service. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.

What to do: Upgrade awslabs.dynamodb-mcp-server to version 2.1.6 or later. Until upgraded, review table, index, and attribute names in data model files (especially ones supplied by AI agents or untrusted sources) for template/inline-code syntax, and inspect generated CDK code before running a deployment. Restrict which MCP-connected clients are allowed to feed data models into the CDK generator.