Skip to content
Sign in
9.2 Critical

CVE-2026-78379 Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before…

Description

Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.

Affected products and versions

Product Affected versions Fixed in
strands-agents-tools 0.8 earliest → < 0.8.5 0.8.5

Other CVEs of strands-agents-tools

The 3 CVEs of strands-agents-tools →
CVE-2026-115415 Secret masking bypass in the environment tool in Strands Agents Tools 5.9 Medium CVE-2026-15746 Strands Agents is an open-source Python SDK for building and running AI agents 6.9 Medium
Track this CVE