🟠 High | Source: AWS Security Bulletins
A command injection vulnerability (CVE-2026-16796) has been identified in the AWS Bedrock AgentCore Python SDK, specifically in the install_packages() method used by its Code Interpreter client. An authenticated remote user could exploit this by passing crafted package name arguments to execute arbitrary commands within the Code Interpreter sandbox. All versions of bedrock-agentcore prior to 1.18.1 are affected.
Security Architect’s Take: Audit any workloads using the bedrock-agentcore SDK and upgrade to version 1.18.1 or later immediately; additionally, review whether untrusted or user-supplied input can reach the install_packages() method and enforce input validation or allowlisting at the application layer as a defence-in-depth measure.
Original advisory: CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()