Skip to content
Sign in
8.4 High

CVE-2026-12530 Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK…

Description

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to version 1.6.1.

Affected products and versions

Product Affected versions Fixed in
bedrock-agentcore 1.1 1.1.3 → < 1.6.1 1.6.1

Other CVEs of bedrock-agentcore

The 2 CVEs of bedrock-agentcore →
CVE-2026-15737 AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on… 5.7 Medium
Track this CVE