Search
Find a vulnerability
Search criteria
2 vulnerabilities found for AgentCore CLI by AWS
CVE-2026-11393 (GCVE-0-2026-11393)
Vulnerability from nvd – Published: 2026-06-08 18:38 – Updated: 2026-06-08 19:45
VLAI
Title
Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
Summary
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.
To remediate this issue, users should upgrade to version 0.14.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/aws/agentcore-cli/releases/tag… | patch |
| https://www.npmjs.com/package/@aws/agentcore/v/0.14.2 | patch |
| https://www.npmjs.com/package/@aws/agentcore/v/1.… | patch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/aws/agentcore-cli/security/adv… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | AgentCore CLI |
Affected:
0.4.0 , ≤ 0.14.1
(custom)
Affected: 0.3.0-preview.7.0 , ≤ 1.0.0-preview.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T19:45:52.025563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T19:45:58.413Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AgentCore CLI",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "0.14.1",
"status": "affected",
"version": "0.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.0.0-preview.8",
"status": "affected",
"version": "0.3.0-preview.7.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.14.1",
"versionStartIncluding": "0.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0-preview.8",
"versionStartIncluding": "0.3.0-preview.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted \u003ccode\u003ecollaborationInstruction\u003c/code\u003e stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.14.2.\u003c/p\u003e"
}
],
"value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242: Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T18:49:55.513Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
},
{
"tags": [
"patch"
],
"url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
},
{
"tags": [
"patch"
],
"url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-11393",
"datePublished": "2026-06-08T18:38:03.960Z",
"dateReserved": "2026-06-05T16:15:22.377Z",
"dateUpdated": "2026-06-08T19:45:58.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11393 (GCVE-0-2026-11393)
Vulnerability from cvelistv5 – Published: 2026-06-08 18:38 – Updated: 2026-06-08 19:45
VLAI
Title
Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
Summary
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.
To remediate this issue, users should upgrade to version 0.14.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/aws/agentcore-cli/releases/tag… | patch |
| https://www.npmjs.com/package/@aws/agentcore/v/0.14.2 | patch |
| https://www.npmjs.com/package/@aws/agentcore/v/1.… | patch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/aws/agentcore-cli/security/adv… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | AgentCore CLI |
Affected:
0.4.0 , ≤ 0.14.1
(custom)
Affected: 0.3.0-preview.7.0 , ≤ 1.0.0-preview.8 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T19:45:52.025563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T19:45:58.413Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AgentCore CLI",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "0.14.1",
"status": "affected",
"version": "0.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.0.0-preview.8",
"status": "affected",
"version": "0.3.0-preview.7.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.14.1",
"versionStartIncluding": "0.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0-preview.8",
"versionStartIncluding": "0.3.0-preview.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted \u003ccode\u003ecollaborationInstruction\u003c/code\u003e stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.14.2.\u003c/p\u003e"
}
],
"value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242: Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T18:49:55.513Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
},
{
"tags": [
"patch"
],
"url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
},
{
"tags": [
"patch"
],
"url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-11393",
"datePublished": "2026-06-08T18:38:03.960Z",
"dateReserved": "2026-06-05T16:15:22.377Z",
"dateUpdated": "2026-06-08T19:45:58.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}