Executive brief
Amazon's DynamoDB Model Context Protocol server is used by AI coding assistants to generate infrastructure-as-code templates for deploying DynamoDB applications. A template injection vulnerability in the CDK code generator allows attackers to inject malicious code through specially crafted table, index, or attribute names, leading to arbitrary code execution on systems that deploy the generated infrastructure.
Technical details
The vulnerability is an improper neutralization of special elements in a template engine (CWE-1336, template injection) within the CDK code generator component of awslabs.dynamodb-mcp-server. The root cause is insufficient sanitization of user-supplied input—specifically table names, index names, and attribute names from data model files—before embedding them into generated CDK code templates. An attacker with the ability to provide or influence a data model file (e.g., by crafting a malicious table schema) can inject arbitrary code that executes when the generated CDK infrastructure is deployed on a target host. This is a context-dependent attack requiring the victim to deploy code generated from an attacker-controlled data model. No authentication bypass or network exploitation is required to inject the malicious payload, but successful exploitation requires that generated code be deployed. Fixed versions beyond 2.1.5 have been released.
Affected products
- Amazon awslabs.dynamodb-mcp-server >= 2.0.10 AND <= 2.1.5
Timeline
- 2026-09-09: disclosed: CVE-2026-85654 disclosed in AWS Security Bulletin 2026-097-AWS
- 2026-09-04: advisory: AWS published security bulletin