pip/bedrock-agentcore: AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
摘要
Severity: HIGH | CVSS: 7.3 | CVE: CVE-2026-16796 | Package: pip/bedrock-agentcore | Affected: < 1.18.1 | Patched: 1.18.1
正文
### Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the install_packages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. ### Impact Insufficient input validation in install_packages() allows specially crafted package specifiers to bypass validation and achieve arbitrary command execution within the sandbox. A remote authenticated user who can influence the arguments to install_packages() can execute arbitrary commands within the Code Interpreter sandbox environment. ### Impacted Versions < 1.18.1 ### Patches This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. ### Workarounds If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers -- before calling the SDK. ### References If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue. ### Acknowledgement AWS would like to thank Sergio Garcia (@MrCloudSec) for collaborating on this issue through the coordinated issue disclosure process.
标签
- ecosystem:pip
- severity:high
- type:reviewed
扩展字段
{
"credits": [
{
"login": "MrCloudSec",
"type": "finder"
}
],
"cve_id": "CVE-2026-16796",
"cvss_score": 7.3,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"cwe_ids": [
"CWE-88"
],
"cwe_names": [
"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"
],
"ghsa_id": "GHSA-j6g5-3hh3-pgw8",
"package": {
"ecosystem": "pip",
"name": "bedrock-agentcore",
"patched_version": "1.18.1",
"vulnerable_range": "< 1.18.1"
},
"references": [
"https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16796",
"https://github.com/aws/bedrock-agentcore-sdk-python/pull/581",
"https://github.com/aws/bedrock-agentcore-sdk-python/commit/3c4b4ee6b8730e6313a82c743ac37dbcc1c21cdb",
"https://aws.amazon.com/security/security-bulletins/2026-065-aws",
"https://pypi.org/project/bedrock-agentcore/1.18.1",
"https://github.com/advisories/GHSA-j6g5-3hh3-pgw8"
],
"source_code_location": "https://github.com/aws/bedrock-agentcore-sdk-python",
"updated_at": "2026-07-24T22:38:57Z"
}