Threats affecting pkg:npm/@aws/agentcore

CVE-2026-11393 is a critical code injection vulnerability in AWS AgentCore CLI versions before 0.14.2. It involves improper neutralization of triple-quote characters during Python code generation, allowing an authenticated remote attacker to execute arbitrary code under the imported agent's IAM execution role and on the local environment of another user in the same AWS account. The vulnerability is remediated by upgrading to version 0.14.2.