CVE-2026-11393 - Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent Import

Summary

CVE-2026-11393 is a code injection flaw in the AWS AgentCore CLI (@aws/agentcore) affecting versions >= 0.4.0 through <= 0.14.1 and preview versions >= 0.3.0-preview.7.0 through <= 1.0.0-preview.8. The collaborationInstruction field of a Bedrock Agent collaborator association is interpolated into a triple-quoted Python docstring using single-quote escaping, so a value containing """ breaks out of the docstring in the main.py generated by "agentcore add agent --type import". An authenticated user in the same AWS account with bedrock:AssociateAgentCollaborator permission can exploit this, and the injected code runs with the credentials of the context where the generated file is executed, via agentcore dev or agentcore deploy followed by agentcore invoke.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()Same vendor · AWS Security Bulletins
• HighCVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro CrewSame vendor · AWS Security Bulletins
• MediumCVE-2026-110248 - Insertion of sensitive information into log files in Amazon SageMaker Python SDKSame vendor · AWS Security Bulletins
• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins