CVE-2026-11393: CWE-94: Improper Control of Generation of Code ('Code Injection') in AWS AgentCore CLI
Bulletin ID: 2026-040-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/08/2026 11:45 AM PDT Description: The AWS AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. We identified CVE-2026-11393 in which improper neutralization of triple-quote characters during Python code generation may allow an authenticated user in the same AWS account to inject arbitrary Python code into the source file generated by the "agentcore add agent ‐‐type import" command. Specifically, the collaborationInstruction field of a Bedrock Agent collaborator association was interpolated into a triple-quoted Python docstring using single-quote escaping rather than triple-quote escaping. A user with bedrock:AssociateAgentCollaborator IAM permission could craft a collaborationInstruction value containing """ to break out of the docstring boundary in the generated main.py of the imported agent. If that generated file was subsequently executed - either via agentcore dev on the developer's local machine, or via agentcore deploy followed by agentcore invoke in the AgentCore Runtime environment - the injected Python would run with the credentials available in that context. Impacted versions: - @aws/agentcore >= 0.4.0 AND = 0.3.0-preview.7.0 and <= 1.0.0-preview.8 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
This vulnerability (CWE-94) in AWS AgentCore CLI prior to version 0.14.2 arises from improper handling of triple-quote characters in Python code generation. An authenticated remote attacker can craft a malicious collaborationInstruction stored on a Bedrock Agent collaborator. When another user imports this agent, the malicious code executes with the imported agent's IAM execution role and on the local environment of that user within the same AWS account. This allows arbitrary code execution with potentially high privileges. AWS has released version 0.14.2 to address this issue.
Potential Impact
Successful exploitation allows an authenticated remote attacker to execute arbitrary code on AWS AgentCore Runtime with the imported agent's IAM execution role and on the local environment of another user in the same AWS account. This can lead to complete compromise of the affected environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.0 (critical).
Mitigation Recommendations
A patch is available. Users should upgrade AWS AgentCore CLI to version 0.14.2 to remediate this vulnerability. Since this is a cloud service, AWS manages remediation for the cloud-hosted components, but users must update their local CLI installations accordingly. Refer to the AWS security advisory at https://aws.amazon.com/security/security-bulletins/2026-040-aws/ for official guidance.
CVE-2026-11393: CWE-94: Improper Control of Generation of Code ('Code Injection') in AWS AgentCore CLI
Description
Bulletin ID: 2026-040-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/08/2026 11:45 AM PDT Description: The AWS AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. We identified CVE-2026-11393 in which improper neutralization of triple-quote characters during Python code generation may allow an authenticated user in the same AWS account to inject arbitrary Python code into the source file generated by the "agentcore add agent ‐‐type import" command. Specifically, the collaborationInstruction field of a Bedrock Agent collaborator association was interpolated into a triple-quoted Python docstring using single-quote escaping rather than triple-quote escaping. A user with bedrock:AssociateAgentCollaborator IAM permission could craft a collaborationInstruction value containing """ to break out of the docstring boundary in the generated main.py of the imported agent. If that generated file was subsequently executed - either via agentcore dev on the developer's local machine, or via agentcore deploy followed by agentcore invoke in the AgentCore Runtime environment - the injected Python would run with the credentials available in that context. Impacted versions: - @aws/agentcore >= 0.4.0 AND = 0.3.0-preview.7.0 and <= 1.0.0-preview.8 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVSS v3.1
Score 9.0critical
Affected software
AWS
AgentCore CLI
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-94) in AWS AgentCore CLI prior to version 0.14.2 arises from improper handling of triple-quote characters in Python code generation. An authenticated remote attacker can craft a malicious collaborationInstruction stored on a Bedrock Agent collaborator. When another user imports this agent, the malicious code executes with the imported agent's IAM execution role and on the local environment of that user within the same AWS account. This allows arbitrary code execution with potentially high privileges. AWS has released version 0.14.2 to address this issue.
Potential Impact
Successful exploitation allows an authenticated remote attacker to execute arbitrary code on AWS AgentCore Runtime with the imported agent's IAM execution role and on the local environment of another user in the same AWS account. This can lead to complete compromise of the affected environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.0 (critical).
Mitigation Recommendations
A patch is available. Users should upgrade AWS AgentCore CLI to version 0.14.2 to remediate this vulnerability. Since this is a cloud service, AWS manages remediation for the cloud-hosted components, but users must update their local CLI installations accordingly. Refer to the AWS security advisory at https://aws.amazon.com/security/security-bulletins/2026-040-aws/ for official guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-06-05T16:15:22.377Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-040-aws/","vendor":"AWS"}]
Threat ID: 6a27120ce29bf47b5072ecb6
Added to database: 06/08/2026, 19:03:40 UTC
Last enriched: 07/30/2026, 07:21:34 UTC
Last updated: 09/12/2026, 22:01:31 UTC
Views: 191
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.