🔴 Critical | Source: AWS Security Bulletins
A prompt injection vulnerability (CVE-2026-18733) in the Strands Agents Tools SDK allows an attacker to bypass the shell tool’s operator consent gate by setting a hidden parameter via a crafted or malicious prompt. This means arbitrary operating system commands could execute on the agent’s host without any human approval. The attack can be triggered indirectly through untrusted content the agent processes, such as a malicious webpage or document.
Security Architect’s Take: Upgrade strands-agents-tools to version 0.8.0 or later immediately; if upgrading is not immediately possible, disable or restrict use of the shell tool entirely and audit agent inputs for untrusted content sources that could carry indirect prompt injection payloads.
Original advisory: CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools