CVE-2026-16796

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

To mitigate this issue, users should upgrade to the patched version 1.18.1.

Vulnerability Details

Published Date

July 23, 2026

Last Modified

July 23, 2026

CWE ID

CWE-88

Source

NVD

Vendor

AWS

Product

bedrock-agentcore 1.18.1

External References

https://aws.amazon.com/security/security-bulletins/2026-065-aws/
https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8
https://pypi.org/project/bedrock-agentcore/1.18.1/

CVE-2026-16796

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment