Improper neutralization of triple‑quote characters during Python code generation in AgentCore CLI before version 0.14.2 allows an authenticated remote threat actor to execute arbitrary code on the AWS AgentCore Runtime within the imported agent's IAM execution role and also on the local environment of another user in the same AWS account. The vulnerability is triggered when a crafted collaborationInstruction is stored on a Bedrock Agent collaborator and later processed by that other user during agent import, leading to full control over the runtime and local system.

AWS provides a product named AgentCore CLI. Versions prior to 0.14.2 are affected. The vulnerability applies to all deployments of this CLI component using the Bedrock Agent collaboration feature.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS score means current exploitation probability is unknown but not negligible. The vulnerability is not listed in CISA's KEV catalog, yet the attack vector requires authentication and the presence of a malicious collaborationInstruction, which could be supplied by an insider or compromised user. If exploited, the attacker could compromise the agent's IAM role permissions and gain persistent access to the underlying host system.