Executive brief
AWS Bedrock AgentCore is a Python SDK for building AI agents on Amazon Bedrock. A command injection vulnerability in the install_packages() function allows attackers to execute arbitrary system commands by injecting malicious argument delimiters, potentially compromising any system running vulnerable agent code.
Technical details
The vulnerability is classified as improper neutralization of argument delimiters (CWE-88 / shell injection). The install_packages() function in the AWS Bedrock AgentCore Python SDK fails to properly sanitize or escape user-controlled input used in system command construction. An attacker can inject shell metacharacters or argument delimiters (such as semicolons, pipes, or backticks) into package names or parameters passed to install_packages(), allowing arbitrary command execution. The attack likely requires either application logic that passes untrusted input to the function, or direct attacker control over agent configuration. This enables remote code execution with the privileges of the Python process executing the SDK.
Affected products
- Amazon AWS Bedrock AgentCore Python SDK <UNKNOWN>
Timeline
- 2026-09-22: disclosed