PT-2026-86207

CVE-2026-85654

·

Published

2026-09-04

·

Updated

2026-10-30

Description by

CVSS 3.1
7.8
High
MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions awslabs.dynamodb-mcp-server versions prior to 2.1.6
Description Improper neutralization of special elements used in a template engine within the CDK generator allows a context-dependent actor to execute arbitrary code on the host deploying the generated application. This occurs when crafted table, index, or attribute names are provided in a data model file, leading to code injection.
Recommendations Update awslabs.dynamodb-mcp-server to version 2.1.6 or later.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Related identifiers
CVE-2026-85654
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com