Executive brief
AWS Bedrock AgentCore Python SDK contains an argument injection vulnerability in the install_packages() function that fails to properly neutralize argument delimiters. An attacker with the ability to control package names or inputs to this function could inject arbitrary command-line arguments, potentially leading to unauthorized code execution or system compromise during the package installation process.
Technical details
This vulnerability is a classic argument injection (CWE-88) in the install_packages() function of the AWS Bedrock AgentCore Python SDK. The root cause is improper neutralization of special characters or delimiters used in command-line arguments when constructing system calls for package installation (likely via pip or similar package managers). An attacker who can influence the package names or version strings passed to install_packages() can inject additional command-line flags or arguments to alter the installer's behavior. This could enable execution of arbitrary code within the context of the SDK, installation of malicious packages, or other system manipulation depending on the installer's capabilities and the SDK's execution context. The vulnerability requires an attacker to have influence over the inputs to install_packages(), which may occur in agent workflows that accept user-supplied package specifications or through application logic that dynamically constructs package lists. Patches are expected from AWS; users should upgrade to patched versions of the SDK when available.
Affected products
- Amazon Web Services Bedrock AgentCore Python SDK
Timeline
- 2026-09-22: disclosed