Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-08 | 1 | Disclosure1 |
| 2026-09-09 | 1 | Patch1 |
Your DynamoDB MCP server can ship RCE with the CDK it generates. CVE-2026-85654: crafted names in dynamodb_data_model.json inject via the CDK generator. Affects awslabs.dynamodb-mcp-server 2.0.10-2.1.5. Pin 2.1.6 tonight vs keep reviewing every model file forever.
Post summary
CVE-2026-85654 reveals an RCE in DynamoDB MCP via crafted JSON names, with a mitigation recommendation to pin to v2.1.6.
CVE-2026-85654: Amazon awslabs.dynamodb-mcp-server < 2.1.6 has an RCE risk via template injection in the CDK generator. Crafted table/index/attribute names in a model file can execute arbitrary code during deployment. CVSS 7.8. No https://www.valtersit.com/cve/CVE-2026-85654/ #valtersit #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali
Post summary
The post announces an RCE vulnerability (CVE‑2026‑85654) in Amazon awslabs.dynamodb‑mcp‑server, describing template injection that allows arbitrary code execution during CDK deployment, with a CVSS score of 7.8; no exploit, PoC or patch information is provided.