The AWS Bedrock AgentCore Python SDK includes a Code Interpreter client that installs Python packages into a managed sandbox environment. CVE-2026-16796 is an improper neutralization of argument delimiters vulnerability in the install_packages() method. This flaw might allow a remote authenticated user to execute arbitrary commands within the sandbox by supplying crafted package name arguments. The vulnerability affects versions of bedrock-agentcore earlier than 1.18.1. AWS has issued a fix in version 1.18.1 and recommends upgrading to this version. As a workaround, users should avoid passing untrusted input to install_packages() and validate package names against strict PyPI naming conventions if dynamic package names are necessary.

A remote authenticated user could exploit this vulnerability to execute arbitrary commands within the Code Interpreter sandbox of the AWS Bedrock AgentCore Python SDK. This could lead to unauthorized command execution within the sandbox environment, potentially compromising the integrity of operations performed by the SDK. The impact is limited to environments using vulnerable versions of the SDK and where the install_packages() method is exposed to crafted input.

A fix is available in bedrock-agentcore version 1.18.1. Users should upgrade to this version to remediate the vulnerability. If upgrading is not immediately possible, do not pass untrusted or model-generated input to the install_packages() method. For applications that must accept dynamic package names, validate these names strictly against PyPI naming rules, including constraining any extras group to comma-separated identifiers, before invoking the SDK. This reduces the risk of command injection via crafted package names.