AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
- Product
- bedrock-agentcore (AWS Bedrock AgentCore Python SDK)
- CVE
- CVE-2026-16796
- Affected
- bedrock-agentcore < 1.18.1
- Fixed in
- 1.18.1
Last verified against sources: October 26, 2026
Am I affected?
bedrock-agentcore (AWS Bedrock AgentCore Python SDK): affected bedrock-agentcore < 1.18.1. Fixed in 1.18.1.
- Check your version: run
pip show bedrock-agentcore. Versions < 1.18.1 of bedrock-agentcore are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "bedrock-agentcore>=1.18.1"(first patched version 1.18.1). [1] - Upgrade to bedrock-agentcore version 1.18.1. [1]
- If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). [1]
- Applications that must accept dynamic package names should validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers -- before calling the SDK. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. [1]
- An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the install_packages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. [1]
- Insufficient input validation in install_packages() allows specially crafted package specifiers to bypass validation and achieve arbitrary command execution within the sandbox. [1]
Impact
- A remote authenticated user who can influence the arguments to install_packages() can execute arbitrary commands within the Code Interpreter sandbox environment. [1]
What was done
Sources
- GHSA-j6g5-3hh3-pgw8 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-16796] AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
Product: bedrock-agentcore (AWS Bedrock AgentCore Python SDK) | Affected: bedrock-agentcore < 1.18.1 | Fixed in: 1.18.1
Summary: The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-16796-bedrock-agentcore-aws-bedrock-agentcore-python-sdkCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-16796
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.