Intelligence
Join the waitlist
AEV-2026-0036

awslabs.dynamodb-mcp-server's CDK generator rendered data model names into TypeScript with no validation or escaping (CVE-2026-85654)

A table's partition key, sort key, every global secondary index key, its non key attributes and its time to live attribute each reached an unescaped single quoted TypeScript string literal in the generated stack.ts.j2 template, while table and index names reached an unvalidated TypeScript identifier position. This entry independently cloned awslabs/mcp and confirmed both gaps directly against the pre fix template, traced the vulnerable code to its own introduction in version 2.0.10, and confirmed the fix, shipped in version 2.1.6, is unchanged on the current default branch, version 2.1.7.

AESS 8.0 highConfirmedStatus: publishedEvent: 4 September 2026Execution AuthorityEnvironment BoundariesSequence Integrity

Affected

Organisation
Amazon Web Services (AWS Labs)
Product
awslabs.dynamodb-mcp-server
Component
CDK generator, stack.ts.j2 template rendering
Versions
2.0.10 through 2.1.5, independently confirmed by this entry as the version range spanning the generator's own introduction and the commit immediately preceding the fix; fixed in 2.1.6
Configurations
Any use of the CDK generator tool against a dynamodb_data_model.json file whose table, index or attribute names are not fully trusted, including a data model an LLM agent itself authored or modified

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Generate an AWS CDK application that provisions the DynamoDB tables and indexes described in a caller supplied dynamodb_data_model.json file
Agent
Whatever MCP client or LLM agent supplies the dynamodb_data_model.json file to the CDK generator tool
Delegating actor
unknown
Action
A table, index or attribute name containing a single quote or another TypeScript special character reached either an unescaped single quoted string literal position or an unvalidated TypeScript identifier position in the generated stack.ts.j2 template, confirmed directly by this entry's own reading of the pre fix template and generator source
Target resource
The generated CDK application's own stack.ts source file, and subsequently whatever the deploying host's own AWS credentials can reach once that file is compiled and deployed
Environment
unknown
Credentials used
unknown
Privileges available
Whatever AWS credentials and host level privileges are available to whoever later compiles and deploys the generated CDK application, confirmed by this entry as a separate principal and a separate moment from generation itself
Authority presented
Authority to invoke the CDK generator tool against a caller supplied data model file, which this entry confirms requires no AWS deployment authority of any kind
Authority required
Authority over whatever the generated stack.ts file actually contains once a crafted name has been rendered into it, which no schema, validation or approval in the reported mechanism separately grants
Applicable policy
unknown
Approval mechanism
unknown
Required approver
unknown
Independent approval
unknown
Action binding
unknown
Sequence context
Generation and deployment are separate actions, confirmed directly by this entry's own reading of the generator source, which contains no code path that compiles or executes the artifact it writes, so the generated artifact can persist for an unbounded interval between the two

Impact

Consequence
Arbitrary TypeScript source injected into a persisted, generated CDK application, demonstrably reachable through a crafted name, confirmed directly by this entry's own reading of the pre fix template's five distinct unescaped interpolation sites and its unvalidated identifier positions
Reach
organisational
Reversibility
unknown
Detectability
unknown
Propagation
A concrete propagation path exists: injected code would run with whatever AWS credentials and host privileges the later deploying principal holds, reaching cloud resources well beyond the generated stack itself, but this entry did not observe that effect actually spreading in a real deployment
Recovery
Fixed in version 2.1.6, confirmed directly by this entry's own cloning of the repository and reading of commit 46ca139f, which validates table and index names against DynamoDB's own permitted character set and wraps every attribute level interpolation in Jinja's tojson filter. This entry independently confirmed that commit is a direct ancestor of the release commit carrying the package from version 2.1.5 to 2.1.6, and separately confirmed the same validation and escaping remain unchanged on the current default branch, version 2.1.7.

Evidence

Primary sources

Supporting sources

Reproduction status
This entry cloned awslabs/mcp directly and read the pre fix template and generator source, the fix commit's own diff, the commit introducing the vulnerable template, the commit first releasing it as version 2.0.10, the commit releasing the fix as version 2.1.6, and the current default branch at version 2.1.7. It did not execute the CDK generator tool itself or a live cdk deploy against a crafted data model file.
Evidence state
Confirmed

Known unknowns

  • Whether the underlying issue was reported privately before this CVE's publication, and by whom
  • Whether any deployment of the CDK generator against an untrusted data model file has actually occurred in production
  • The AWS Security Bulletin's own exact text and publication time, since aws.amazon.com was blocked to this session on every attempted route
  • Which body served as the assigning CVE Numbering Authority, since cve.org and nvd.nist.gov were both blocked to this session on every attempted route

Limitations

  • aws.amazon.com, nvd.nist.gov, cve.org, vuldb.com and radar.offseq.com were all blocked by this session's own network egress policy on every attempted route, so this entry relies on the GitHub Advisory Database for CVE and CVSS metadata rather than a direct reading of the AWS bulletin or the CVE Program's own page.
  • This entry did not run the CDK generator tool or a live cdk deploy end to end against a crafted data model file; its confirmation of the mechanism rests on a direct reading of the affected and fixed source rather than a reproduced exploit.

Claim provenance

  • verified
    This session fetched the GitHub Security Advisory directly and confirmed CVE-2026-85654, GHSA-hh4r-pcm9-jh93, CVSS 4.0 base score 7.1, High, CWE-1336, published 4 September 2026, against Amazon awslabs.dynamodb-mcp-server, stating the CDK generator before version 2.1.6 might allow arbitrary code execution on the host that deploys the generated application via crafted table, index or attribute names. Confirmed the advisory carries no structured affected version range for a supported package ecosystem.
    The Data Model Named a Table. The Generated Stack Executed What It Said.
  • verified
    This session cloned awslabs/mcp directly and read this commit's complete diff against generator.py, models.py and stack.ts.j2, confirming the pre fix template interpolated every attribute, key and time to live name as a bare single quoted TypeScript string literal with no escaping, and interpolated every table and index name into a TypeScript identifier position with no character set or length validation, and confirming the fix closes both gaps as described.
    The Data Model Named a Table. The Generated Stack Executed What It Said.
  • verified
    This session cloned awslabs/mcp directly and confirmed, through git log --follow against stack.ts.j2, that commit 15e43c67 is the sole commit before the fix to introduce or modify that template, at a point where the package's own pyproject.toml read version 2.0.9, and confirmed the very next commit touching that file, 0bb449ef, bumps it to version 2.0.10, independently establishing the affected range's own lower bound rather than repeating the advisory's unstated one.
    The Data Model Named a Table. The Generated Stack Executed What It Said.
  • verified
    This session confirmed, through a direct git ancestry check in the cloned repository, that the fix commit is an ancestor of commit eff6cce0, which changes the package's own pyproject.toml from version 2.1.5 to version 2.1.6, and separately confirmed by reading the current default branch that version 2.1.7 still carries the identical validation and escaping.
    The Data Model Named a Table. The Generated Stack Executed What It Said.