High severity7.8NVD Advisory· Published Sep 4, 2026

CVE-2026-85654

Description

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Amazon/awslabs.dynamodb-mcp-serverllm-create
Range: <2.1.6

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-097-aws/nvd
pypi.org/project/awslabs.dynamodb-mcp-server/2.1.6/nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000