by Kastro
Paper/Archive/CVE-2026-11393

CVE-2026-11393

AWS AgentCore CLI — Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

EPSS 0.3%CVSS 9.0
critical.is priorityof 100
33
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 27.5.275 × 205.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import. To remediate this issue, users should upgrade to version 0.14.2.

Affected

ProductAffectedFixed inSource
AgentCore CLI0.4.0 – 0.14.1–CNA
AgentCore CLI0.3.0-preview.7.0 – 1.0.0-preview.8–CNA

Scores by source

AMZN (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
AMZN (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/aws/agentcore-cli/releases/tag/v0.14.2patchnpmjs.com/package/@aws/agentcore/v/0.14.2patchnpmjs.com/package/@aws/agentcore/v/1.0.0-preview.9advisoryaws.amazon.com/security/security-bulletins/2026-040-awswriteupgithub.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7