{"uuid": "a39548ac-8ab7-4d2b-8299-ae0c83a44699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-11393", "type": "seen", "source": "https://gist.github.com/alon710/7771115a3d9e03361e58ecd1b540d28d", "content": "# CVE-2026-11393: CVE-2026-11393: Code Injection via Improper Triple-Quote Escaping in AWS AgentCore CLI\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-11393\n\n## Summary\nA critical code injection vulnerability exists in @aws/agentcore CLI (AWS AgentCore CLI) during the Bedrock Agent import lifecycle. An authenticated remote attacker with permissions to configure Bedrock collaborator attributes can inject python code by embedding triple-double-quotes (\"\"\") inside the collaborationInstruction metadata field. The CLI formats this metadata directly into a Python docstring in a generated main.py file without adequate escaping, leading to arbitrary code execution when the imported agent is run or deployed.\n\n## TL;DR\nImproper validation of triple-double-quotes in AWS AgentCore CLI's Bedrock Agent import allows remote code execution when local or cloud environments execute generated code.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (Low Privileges Required)\n- **CVSS v3.1**: 9.0 (Critical)\n- **EPSS Score**: 0.00322\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @aws/agentcore CLI\n- Amazon Bedrock Agent Import Lifecycle\n- **@aws/agentcore (Stable)**: >= 0.4.0 to <= 0.14.1 (Fixed in: `0.14.2`)\n- **@aws/agentcore (Preview)**: >= 0.3.0-preview.7.0 to <= 1.0.0-preview.8 (Fixed in: `1.0.0-preview.9`)\n\n## Mitigation\n\n- Upgrade `@aws/agentcore` to version 0.14.2 (stable) or 1.0.0-preview.9 (preview)\n- Restrict IAM permissions for Bedrock Agent configuration updates\n- Perform code reviews of generated `main.py` files prior to execution\n\n**Remediation Steps:**\n1. Identify active installations of @aws/agentcore CLI\n2. Execute 'npm install -g @aws/agentcore@0.14.2' or upgrade the local package dependency\n3. Scan local python files for unescaped triple quotes inside 'collaboratorInstruction'\n4. Audit CloudTrail logs for bedrock-agent:UpdateAgentCollaborator events\n\n## References\n\n- [https://aws.amazon.com/security/security-bulletins/2026-040-aws/](https://aws.amazon.com/security/security-bulletins/2026-040-aws/)\n- [https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7](https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-11393](https://nvd.nist.gov/vuln/detail/CVE-2026-11393)\n- [https://www.cve.org/CVERecord?id=CVE-2026-11393](https://www.cve.org/CVERecord?id=CVE-2026-11393)\n- [https://github.com/aws/agentcore-cli/pull/1329](https://github.com/aws/agentcore-cli/pull/1329)\n- [https://github.com/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504](https://github.com/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504)\n- [https://github.com/aws/agentcore-cli/releases/tag/v0.14.2](https://github.com/aws/agentcore-cli/releases/tag/v0.14.2)\n- [https://www.npmjs.com/package/@aws/agentcore/v/0.14.2](https://www.npmjs.com/package/@aws/agentcore/v/0.14.2)\n- [https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9](https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-11393) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T09:32:05.245981Z"}