The Bedrock AgentCore Python SDK contains a flaw where the install_packages() method does not properly neutralize special characters that act as argument delimiters. A crafted package name can therefore pass shell commands to the Code Interpreter sandbox, allowing an authenticated user to execute arbitrary commands within that sandbox. The vulnerability is limited to code executed inside the sandbox and does not present an explicit mechanism for escaping the sandbox boundary according to the description.

Any deployment that uses the AWS Bedrock AgentCore Python SDK version earlier than 1.18.1 is vulnerable. The affected product is AWS Bedrock AgentCore, and the issue is present in all releases older than the patched 1.18.1 version.

The CVSS score of 8.4 indicates high severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated user to invoke install_packages() with a crafted argument; the attack vector is therefore a remote authenticated user. Successful exploitation would enable the attacker to run arbitrary commands within the sandbox environment.