A high-severity remote code execution vulnerability in the Amazon awslabs.dynamodb-mcp-server CDK generator poses a significant risk to the integrity and security of host systems deploying generated applications.

The vulnerability arises from improper neutralization of special elements within the template engine (CWE-1336). An attacker can supply crafted table, index, or attribute names in a data model file to trigger arbitrary code execution on the host system during the deployment process, requiring user interaction and specific local conditions.

The potential for arbitrary code execution on host systems constitutes a critical business risk, as it allows attackers to bypass security controls and gain unauthorized control over deployment infrastructure. Given the CVSS score of 7.8, this vulnerability represents a high threat that could lead to full system compromise, data theft, or the injection of malicious infrastructure components.

Immediate Action: Update the awslabs.dynamodb-mcp-server package to version 2.1.6 or later immediately to incorporate the necessary template neutralization fixes.

Proactive Monitoring: Review deployment pipelines and CI/CD logs for unexpected execution patterns or unauthorized modifications to data model definitions.

Compensating Controls: Implement strict input validation and sanitization for all data model files before they are processed by the CDK generator to ensure that only trusted configurations are deployed.

Public Exploit Available: No

Organizations utilizing the Amazon awslabs.dynamodb-mcp-server library must prioritize upgrading to version 2.1.6 to eliminate this code execution vector. Failure to patch allows for potential host-level compromise during the application build and deployment phase, which could have cascading effects on the security of the entire production environment.