This vulnerability is a prompt injection flaw that allows an attacker to inject a crafted prompt setting the non_interactive parameter to true, thereby bypassing the human consent gate in the shell tool. The flaw enables the execution of arbitrary operating system commands on the host where the agent runs, representing a serious threat to confidentiality, integrity, and availability of the system. The weakness is categorized as CWE‑1427, which pertains to improper trust boundary enforcement for user‑supplied parameters.

Amazon Web Services’ Strands Agents Tools is affected when it runs any version older than 0.8.0. The vulnerability applies to all supported platform builds of the tool in that version range. No specific sub‑set of sub‑components is required; the entire shell tool functionality can be leveraged.

The CVSS score for this vulnerability is 7.5, indicating a high level of seriousness. EPSS data is not available in the current data set, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the flaw can be triggered by an external actor sending a crafted prompt to the shell tool. Because it relies on an ability to bypass the consent gate, any compromised or malicious user with access to the tool’s input interface can raise the privilege level of the agent to execute arbitrary OS commands.