Executive brief
AWS AgentCore CLI is a command-line tool used to manage Bedrock agents for generative AI applications. A code injection vulnerability in the Bedrock Agent Import feature allows an attacker to execute arbitrary code by exploiting improper escaping of triple-quoted strings. This could enable an attacker to compromise systems running the CLI and access sensitive AI agent configurations and resources.
Technical details
The vulnerability is a code injection flaw in AWS AgentCore CLI's Bedrock Agent Import feature, caused by improper escaping of triple-quoted strings in agent configuration data. The vulnerable component processes user-supplied agent definitions without adequately sanitizing triple-quote delimiters, allowing injection of arbitrary code that gets executed during the import process. Attack vector is local via CLI invocation with a specially crafted agent import file; no authentication bypass or network access is required beyond initial CLI access. An attacker with the ability to provide or modify agent import files can execute arbitrary code with the privileges of the user running the CLI, potentially compromising credentials, exfiltrating agent data, or modifying AI agent configurations. AWS has published a security bulletin (2026-040-aws) addressing this issue; users should update AgentCore CLI to the patched version.
Affected products
- AWS AgentCore CLI <UNKNOWN>
Timeline
- 2026-09-22: disclosed: CVE-2026-11393 disclosed in AWS Security Bulletin 2026-040-aws