CVE-2026-85654 - Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
Summary
Amazon awslabs.dynamodb-mcp-server, an open-source tool that lets AI assistants work with Amazon DynamoDB (a database service), has a code injection vulnerability in its CDK generator (the part that creates infrastructure-as-code templates). An attacker could craft malicious table or attribute names in a data model file to execute arbitrary code on the host machine that deploys the generated application.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://aws.amazon.com/security/security-bulletins/rss/2026-097-aws/
First tracked: September 4, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 92%