Is CVE-2026-85654 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85654?

CVE-2026-85654 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-85654

Description

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.