CVE-2026-85654
CVE-2026-85654
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-85654?
- CVE-2026-85654 is a high-severity vulnerability, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 7.8/10. Published 2026-09-04.
- How severe is CVE-2026-85654?
- High severity. CVSS v3 base score is 7.8 out of 10.