Vulnerability-Lookup

GHSA-M4X6-GWGP-4PM7

Vulnerability from github – Published: 2026-07-29 16:10 – Updated: 2026-07-29 16:10

Summary

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

Details

Summary

The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the agentcore add agent --type import command, resulting in arbitrary code execution when the generated file is loaded or deployed.

Impact

When a user runs agentcore add agent --type import to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python statements into the generated source file.

An authenticated AWS user in the same account with the bedrock:AssociateAgentCollaborator IAM permission can associate a collaborator agent carrying a crafted collaborationInstruction with a supervisor agent. A developer who subsequently imports that supervisor agent using an affected CLI version will have the injected code written to their local main.py of the imported agent. The injected code executes in two contexts: on the developer's local machine when running agentcore dev, under the developer's local AWS credentials; and in the AWS AgentCore Runtime environment when the developer runs agentcore deploy followed by agentcore invoke, under the agent's IAM execution role.

Customers who have already imported a supervisor agent using an affected version and deployed it to AWS remain exposed on every agent invocation until they regenerate and redeploy the agent using a patched CLI version.

Impacted versions: @aws/agentcore >= 0.4.0 AND <= 0.14.1, preview >= 0.3.0-preview.7.0 AND <= 1.0.0-preview.8

Patches

This issue has been addressed in AgentCore CLI version 0.14.2 and preview version 1.0.0-preview.9. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Customers who have previously run agentcore add agent --type import on an affected version must also remove the affected agent from their project, re-run the import with the patched CLI to regenerate a clean main.py for the imported agent, and redeploy their agent to AWS to replace the previously deployed artifact. Upgrading the CLI alone does not remediate already-generated or already-deployed code.

Workarounds

If an immediate upgrade is not possible, customers can manually inspect the generated main.py of the imported agent for any collaboratorInstruction values that contain triple double-quote character sequences and replace each occurrence with escaped equivalents before running agentcore dev or agentcore deploy.

References

If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

9.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aws/agentcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0"
            },
            {
              "fixed": "0.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aws/agentcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.3.0-preview.7.0"
            },
            {
              "last_affected": "0.3.0-preview.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aws/agentcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-preview.1"
            },
            {
              "fixed": "1.0.0-preview.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-11393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T16:10:46Z",
    "nvd_published_at": "2026-06-08T19:16:41Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the `agentcore add agent --type import` command, resulting in arbitrary code execution when the generated file is loaded or deployed.\n\n### Impact\nWhen a user runs `agentcore add agent --type import` to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python statements into the generated source file.\n\nAn authenticated AWS user in the same account with the bedrock:AssociateAgentCollaborator IAM permission can associate a collaborator agent carrying a crafted collaborationInstruction with a supervisor agent. A developer who subsequently imports that supervisor agent using an affected CLI version will have the injected code written to their local main.py of the imported agent. The injected code executes in\u00a0 two contexts: on the developer\u0027s local machine when running `agentcore dev`, under the developer\u0027s local AWS credentials; and in the AWS AgentCore Runtime environment when the developer runs `agentcore deploy` followed by agentcore invoke, under the agent\u0027s IAM execution role.\n\nCustomers who have already imported a supervisor agent using an affected version and deployed it to AWS remain exposed on every agent invocation until they regenerate and redeploy the agent using a patched CLI version.\n\n**Impacted versions:** @aws/agentcore \u003e= 0.4.0 AND \u003c= 0.14.1, preview \u003e= 0.3.0-preview.7.0 AND \u003c= 1.0.0-preview.8\n\n### Patches\nThis issue has been addressed in AgentCore CLI version 0.14.2 and preview version 1.0.0-preview.9. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nCustomers who have previously run `agentcore add agent --type import` on an affected version must also remove the affected agent from their project, re-run the import with the patched CLI to regenerate a clean main.py for the imported agent, and redeploy their agent to AWS to replace the previously deployed artifact. Upgrading the CLI alone does not remediate already-generated or already-deployed code.\n\n### Workarounds\nIf an immediate upgrade is not possible, customers can manually inspect the generated main.py of the imported agent for any collaboratorInstruction values that contain triple double-quote character sequences and replace each occurrence with escaped equivalents before running `agentcore dev` or `agentcore deploy`.\n\n### References\nIf you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
  "id": "GHSA-m4x6-gwgp-4pm7",
  "modified": "2026-07-29T16:10:46Z",
  "published": "2026-07-29T16:10:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11393"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/agentcore-cli/pull/1329"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504"
    },
    {
      "type": "WEB",
      "url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aws/agentcore-cli"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping"
}

CVE-2026-11393 (GCVE-0-2026-11393)

Vulnerability from cvelistv5 – Published: 2026-06-08 18:38 – Updated: 2026-06-08 19:45

Title

Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

Summary

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import. To remediate this issue, users should upgrade to version 0.14.2.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

AMZN

References

5 references

URL	Tags
https://github.com/aws/agentcore-cli/releases/tag…	patch
https://www.npmjs.com/package/@aws/agentcore/v/0.14.2	patch
https://www.npmjs.com/package/@aws/agentcore/v/1.…	patch
https://aws.amazon.com/security/security-bulletin…	vendor-advisory
https://github.com/aws/agentcore-cli/security/adv…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
AWS	AgentCore CLI	Affected: 0.4.0 , ≤ 0.14.1 (custom) Affected: 0.3.0-preview.7.0 , ≤ 1.0.0-preview.8 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T19:45:52.025563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T19:45:58.413Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AgentCore CLI",
          "vendor": "AWS",
          "versions": [
            {
              "lessThanOrEqual": "0.14.1",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.0.0-preview.8",
              "status": "affected",
              "version": "0.3.0-preview.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.14.1",
                  "versionStartIncluding": "0.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.0-preview.8",
                  "versionStartIncluding": "0.3.0-preview.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted \u003ccode\u003ecollaborationInstruction\u003c/code\u003e stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.14.2.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent\u0027s IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242: Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T18:49:55.513Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-11393",
    "datePublished": "2026-06-08T18:38:03.960Z",
    "dateReserved": "2026-06-05T16:15:22.377Z",
    "dateUpdated": "2026-06-08T19:45:58.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-M4X6-GWGP-4PM7

Summary

Impact

Patches

Workarounds

References

CVE-2026-11393 (GCVE-0-2026-11393)

Tags

Sightings

Nomenclature