Vulnerability-Lookup

FKIE_CVE-2026-11393

Vulnerability from fkie_nvd - Published: 2026-06-08 19:16 - Updated: 2026-07-23 08:10

Severity

9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Summary

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import. To remediate this issue, users should upgrade to version 0.14.2.

References

	URL	Tags
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://aws.amazon.com/security/security-bulletins/2026-040-aws/
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/aws/agentcore-cli/releases/tag/v0.14.2
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://www.npmjs.com/package/@aws/agentcore/v/0.14.2
	ff89ba41-3aa1-4d27-914a-91399e9639e5	https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "AgentCore CLI",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "0.14.1",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.0-preview.8",
              "status": "affected",
              "version": "0.3.0-preview.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."
    },
    {
      "lang": "es",
      "value": "La neutralizaci\u00f3n incorrecta de caracteres de triple comilla durante la generaci\u00f3n de c\u00f3digo Python en AgentCore CLI antes de la v0.14.2 podr\u00eda permitir que un actor de amenaza remoto autenticado ejecute c\u00f3digo arbitrario en el tiempo de ejecuci\u00f3n de AWS AgentCore bajo el rol de ejecuci\u00f3n de IAM del agente importado y en el entorno local de otro usuario en la misma cuenta de AWS, a trav\u00e9s de una collaborationInstruction especialmente dise\u00f1ada almacenada en un colaborador de Bedrock Agent y procesada posteriormente por ese otro usuario durante la importaci\u00f3n del agente.\n\nPara remediar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n 0.14.2."
    }
  ],
  "id": "CVE-2026-11393",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11393",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-08T19:45:52.025563Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-08T19:16:41.270",
  "references": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
    },
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
    }
  ],
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary"
    }
  ]
}

CVE-2026-11393 (GCVE-0-2026-11393)

Vulnerability from cvelistv5 – Published: 2026-06-08 18:38 – Updated: 2026-06-08 19:45

Title

Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

Summary

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

AMZN

References

5 references

URL	Tags
https://github.com/aws/agentcore-cli/releases/tag…	patch
https://www.npmjs.com/package/@aws/agentcore/v/0.14.2	patch
https://www.npmjs.com/package/@aws/agentcore/v/1.…	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/aws/agentcore-cli/security/adv…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
AWS	AgentCore CLI	Affected: 0.4.0 , ≤ 0.14.1 (custom) Affected: 0.3.0-preview.7.0 , ≤ 1.0.0-preview.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T19:45:52.025563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T19:45:58.413Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AgentCore CLI",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "0.14.1",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.0-preview.8",
              "status": "affected",
              "version": "0.3.0-preview.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.14.1",
                  "versionStartIncluding": "0.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.0-preview.8",
                  "versionStartIncluding": "0.3.0-preview.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted \u003ccode\u003ecollaborationInstruction\u003c/code\u003e stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.14.2.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242: Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T18:49:55.513Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-11393",
    "datePublished": "2026-06-08T18:38:03.960Z",
    "dateReserved": "2026-06-05T16:15:22.377Z",
    "dateUpdated": "2026-06-08T19:45:58.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

FKIE_CVE-2026-11393

CVE-2026-11393 (GCVE-0-2026-11393)

Tags

Sightings

Nomenclature