EUVD-2026-52432Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Shell tool must be enabled and processing untrusted input (AC:H); scope changes from agent context to host OS (S:C); no attacker credentials required (PR:N).
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate.
To remediate this issue, users should upgrade to version 0.8.0.
AnalysisAI
Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's non_interactive parameter to true, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Strands shell tool must be enabled in the agent's tool configuration - agents that do not register or use the shell tool are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system (VC:H/VI:H/VA:H), with no impact on subsequent systems (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade strands-agents-tools to version 0.8.0 or later via pip (`pip install strands-agents-tools>=0.8.0`), available at https://pypi.org/project/strands-agents-tools/0.8.0/ and confirmed by the AWS advisory at https://aws.amazon.com/security/security-bulletins/2026-072-aws/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Amazon Strands Agents Tools deployments across your environment and identify all systems running versions prior to 0.8.0, with priority flagging for instances with shell tool functionality enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Strands Agents Tools
View allCredential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to atta
Server-side request forgery in the strands-agents-tools elasticsearch_memory tool enables prompt-injection attacks that
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today