EUVD-2026-35187CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.
To remediate this issue, users should upgrade to version 0.14.2.
AnalysisAI
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via crafted collaborationInstruction strings stored on Bedrock Agent collaborators. When another user in the same AWS account imports the agent, the malicious triple-quote payload breaks out of the generated Python docstring and executes attacker-controlled code on AWS AgentCore Runtime under the imported agent's IAM execution role, as well as on the importing user's local environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must (1) hold authenticated AWS credentials with permission to set the collaborationInstruction field on a Bedrock Agent collaborator in the target account, and (2) induce a second user in the same AWS account to run the AgentCore CLI import command against that collaborator - UI:R in the CVSS vector reflects this required victim action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H yields 9.0 and reflects the cross-tenant blast radius: a low-privileged authenticated actor in one AWS account context plants a payload, and a second user's import (UI:R) detonates it, with Scope:Changed because execution spreads to AgentCore Runtime under a different IAM role plus the victim's local workstation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with permission to update a Bedrock Agent collaborator in a shared AWS account sets its collaborationInstruction to a string that closes the generated Python triple-quoted docstring and appends malicious Python (for example, code that exfiltrates AWS credentials or writes an SSH key). A teammate later runs agentcore import to pull that collaborator into their own workflow; the CLI emits and executes the poisoned Python both locally on the teammate's workstation and on AWS AgentCore Runtime under the imported agent's IAM execution role, giving the attacker code execution in two distinct trust contexts. … |
| Remediation | Vendor-released patch: upgrade AgentCore CLI to v0.14.2 (npm install -g @aws/agentcore@0.14.2) or, if tracking the preview line, to 1.0.0-preview.9; the fix is PR #1329 which escapes triple-quote sequences in collaborationInstruction before they are embedded in generated Python. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all AWS AgentCore CLI installations and document current versions across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the T
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
Path traversal in NASA AMMOS AIT-Core's Binary Stream Capture (BSC) component allows unauthenticated remote attackers to
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when gu
Share
External POC / Exploit Code
Leaving vuln.today