CVE-2026-16796 Details
Description
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to the patched version 1.18.1.
A vulnerability exists in the AWS Bedrock AgentCore Python SDK, specifically in versions prior to 1.18.1. The issue arises from improper handling of argument delimiters in the install_packages() method. This flaw could enable a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox by manipulating package name arguments. The Code Interpreter client, part of the SDK, installs Python packages into a managed sandbox, where this vulnerability could be exploited.
Users are advised to upgrade to AWS Bedrock AgentCore Python SDK version 1.18.1 or later. If an upgrade is not possible, do not pass untrusted or model-generated input to the install_packages() method. Applications that need to accept dynamic package names should validate them against strict PyPI naming conventions before using the SDK.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | AMZN |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | AMZN |