High, CVSS 8.8npmPublished
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
CVE-2026-11393 · GHSA-m4x6-gwgp-4pm7
- Affected
- npm @aws/agentcore >= 0.4.0, < 0.14.2; >= 0.3.0-preview.7.0, <= 0.3.0-preview.9.0; >= 1.0.0-preview.1, < 1.0.0-preview.9
- Fixed in
- 1.0.0-preview.90.14.2· Partial vendor fix
- Issue
- The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the agentcore add agent --type import command, resulting in arbitrary code execution when the generated file is loaded or deployed. Impact When a user runs agentcore add agent --type import to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python…
Recommended action: Upgrade to 1.0.0-preview.9 (pre-release) or 0.14.2 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.