Is CVE-2026-18733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18733 being exploited in the wild.

How severe is CVE-2026-18733?

High severity, with a CVSS score of 8.8, published 3 August 2026.

Which products and versions are affected?

Amazon Strands-Agents-Tools before 0.8.0.

Is there a fix for CVE-2026-18733?

A patch was published on 2026-08-03: Version 0.8.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18733 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18733?

Check whether you run Amazon AWS or Amazon Strands-Agents-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18733: Amazon Strands Agents Tools prompt injection in shell tool

CVE-2026-18733 · Severity: high · CVSS 8.8 · Published 2026-08-03

Amazon Strands Agents Tools is a library providing pre-built tools for building AI agents that can execute system commands on a host machine. A prompt injection vulnerability in the shell tool allows attackers to bypass the human approval gate and execute arbitrary operating system commands with the privileges of the agent process by injecting crafted text into content the agent reads, such as web pages or messages.

Technologies: Amazon AWS, Amazon Strands-Agents-Tools. Vendors: Amazon.

Quick answers

Is CVE-2026-18733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18733 being exploited in the wild.
How severe is CVE-2026-18733?: High severity, with a CVSS score of 8.8, published 3 August 2026.
Which products and versions are affected?: Amazon Strands-Agents-Tools before 0.8.0.
Is there a fix for CVE-2026-18733?: A patch was published on 2026-08-03: Version 0.8.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18733 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18733?: Check whether you run Amazon AWS or Amazon Strands-Agents-Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a prompt injection vulnerability (CWE-1427) in the shell tool component of Strands Agents Tools. The shell tool exposes a non_interactive parameter in its LLM-controllable input schema; when set to true, this parameter bypasses the human consent gate that normally requires operator approval before executing commands. An attacker can indirectly inject a crafted prompt into untrusted content (web pages, Slack messages, files) that the agent reads, causing the LLM to set non_interactive=true in the same tool call, thereby skipping the approval gate. The attacker can then execute arbitrary OS commands with the privileges of the agent process. The vulnerability affects versions before 0.8.0 and requires user interaction (the agent must process untrusted content) but no authentication. The issue is patched in version 0.8.0, where the non_interactive parameter can no longer bypass the consent gate.

Affected products

Amazon Strands Agents Tools before 0.8.0

Timeline

2026-08-03: disclosed
2026-08-03: patched: Version 0.8.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.