{"vulnerability": "CVE-2026-11393", "sightings": [{"uuid": "a39548ac-8ab7-4d2b-8299-ae0c83a44699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11393", "type": "seen", "source": "https://gist.github.com/alon710/7771115a3d9e03361e58ecd1b540d28d", "content": "# CVE-2026-11393: CVE-2026-11393: Code Injection via Improper Triple-Quote Escaping in AWS AgentCore CLI\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-11393\n\n## Summary\nA critical code injection vulnerability exists in @aws/agentcore CLI (AWS AgentCore CLI) during the Bedrock Agent import lifecycle. An authenticated remote attacker with permissions to configure Bedrock collaborator attributes can inject python code by embedding triple-double-quotes (\"\"\") inside the collaborationInstruction metadata field. The CLI formats this metadata directly into a Python docstring in a generated main.py file without adequate escaping, leading to arbitrary code execution when the imported agent is run or deployed.\n\n## TL;DR\nImproper validation of triple-double-quotes in AWS AgentCore CLI's Bedrock Agent import allows remote code execution when local or cloud environments execute generated code.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (Low Privileges Required)\n- **CVSS v3.1**: 9.0 (Critical)\n- **EPSS Score**: 0.00322\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @aws/agentcore CLI\n- Amazon Bedrock Agent Import Lifecycle\n- **@aws/agentcore (Stable)**: >= 0.4.0 to <= 0.14.1 (Fixed in: `0.14.2`)\n- **@aws/agentcore (Preview)**: >= 0.3.0-preview.7.0 to <= 1.0.0-preview.8 (Fixed in: `1.0.0-preview.9`)\n\n## Mitigation\n\n- Upgrade `@aws/agentcore` to version 0.14.2 (stable) or 1.0.0-preview.9 (preview)\n- Restrict IAM permissions for Bedrock Agent configuration updates\n- Perform code reviews of generated `main.py` files prior to execution\n\n**Remediation Steps:**\n1. Identify active installations of @aws/agentcore CLI\n2. Execute 'npm install -g @aws/agentcore@0.14.2' or upgrade the local package dependency\n3. Scan local python files for unescaped triple quotes inside 'collaboratorInstruction'\n4. Audit CloudTrail logs for bedrock-agent:UpdateAgentCollaborator events\n\n## References\n\n- [https://aws.amazon.com/security/security-bulletins/2026-040-aws/](https://aws.amazon.com/security/security-bulletins/2026-040-aws/)\n- [https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7](https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-11393](https://nvd.nist.gov/vuln/detail/CVE-2026-11393)\n- [https://www.cve.org/CVERecord?id=CVE-2026-11393](https://www.cve.org/CVERecord?id=CVE-2026-11393)\n- [https://github.com/aws/agentcore-cli/pull/1329](https://github.com/aws/agentcore-cli/pull/1329)\n- [https://github.com/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504](https://github.com/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504)\n- [https://github.com/aws/agentcore-cli/releases/tag/v0.14.2](https://github.com/aws/agentcore-cli/releases/tag/v0.14.2)\n- [https://www.npmjs.com/package/@aws/agentcore/v/0.14.2](https://www.npmjs.com/package/@aws/agentcore/v/0.14.2)\n- [https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9](https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-11393) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T09:32:05.245981Z"}, {"uuid": "593284b2-0067-403a-9831-f3024dd7a21b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11393", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnsgig75ae2a", "content": "CVE-2026-11393 - Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import\nCVE ID : CVE-2026-11393\n \n Published : June 8, 2026, 6:38 p.m. | 37\u00a0minutes ago\n \n Description : Improper neutralization of triple-quote characters during Python code gener...", "creation_timestamp": "2026-06-08T19:35:27.431869Z"}, {"uuid": "0e3fbfa7-1e56-414d-bfdc-09ad764fc525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11393", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mnshvnuq3g2y", "content": "\ud83d\udd34 CVE-2026-11393 - Critical (9)\n\nImproper neutralization of triple-quote characters during Python code generation in AgentCore CLI...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-11393/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-08T20:02:37.083067Z"}, {"uuid": "14a408fb-0610-4dc9-94c1-cdbfeae3ce76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11393", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsezplhpr24", "content": "CVE-2026-11393 - agentcore\nA security issue exists in the AgentCore CLI before version 0.14.2. An attacker with access to your AWS account could potentially execute unauthorized code on your system if\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#agentcore #aws #npm #CVE #infosec", "creation_timestamp": "2026-07-29T16:50:06.404566Z"}]}