Technical impact
The vulnerability involves an improper neutralization of argument delimiters in the install_packages() method of the AWS Bedrock AgentCore Python SDK. A remote authenticated attacker can supply a crafted package name that causes arbitrary commands to be executed inside the Code Interpreter sandbox. This flaw corresponds to CWE-88 and enables the attacker to compromise the integrity of the sandbox environment, potentially leading to the execution of malicious code.
Affected Systems
The issue affects AWS Bedrock AgentCore Python SDK versions 1.1.3 up to but not including 1.6.1. Organizations that invoke the install_packages() function within these releases are vulnerable. The affected product is the Bedrock AgentCore SDK supplied by Amazon Web Services.
Risk and Exploitability
The CVSS score of 8.4 indicates a high severity. The EPSS score of less than 1% shows that exploitation is unlikely on a widespread basis yet possible. Based on the description, the likely attack vector is limited to authenticated users with valid AWS credentials and a code‑execution context. The vulnerability is not listed in CISA’s KEV catalog, so no off‑the‑shelf exploits are publicly known. Nonetheless, the insecure handling of delimiters presents a significant risk for any deployment that relies on install_packages for dependency installation.
Github GHSA