The vulnerability arises from improper control of code generation in the Bedrock AgentCore Starter Toolkit’s agent import functionality. Prior to version 0.3.14, the toolkit incorporated user‑supplied configuration values directly into generated Python source without safe literal encoding, enabling an attacker with proper authentication in the same AWS account to inject arbitrary code. The bug is classified as a Code Injection flaw (CWE-94) and can lead to remote code execution if the imported agent is executed or deployed.

The affected product is the Amazon Bedrock AgentCore Starter Toolkit, provided by AWS. The issue exists in all releases prior to 0.3.14. Any instance of the toolkit installed under those versions that processes agent imports is vulnerable. Users migrating to a newer release are no longer affected.

The CVSS score of 8.8 indicates high severity. Exploitation would require the attacker to have permissions to import an agent in the same AWS account and provide crafted configuration values. While the EPSS score is not available, the missing KEV listing suggests no widespread exploitation yet. Nonetheless, because the flaw permits arbitrary code execution within the user’s account, the risk remains significant, especially in environments where agent deployment scripts are executed automatically.