Strands Agents Tools EUVD-2026-65735

Exploitation requires that the target agent has the python_repl tool enabled AND exposes the batch tool through which keyword arguments can be forwarded, running on strands-agents-tools before 0.8.5. The concrete trigger is a crafted prompt that passes non_interactive_mode as a keyword argument via the batch tool to python_repl, which suppresses the human consent gate. Limiting factors: the attacker must be able to influence the agent's prompt/context (directly or via indirect injection through retrieved content), and success is probabilistic per CVSS AT:P - the model must actually honor the injected instruction - so it is not deterministic. Agents that do not register python_repl, or that hard-enforce operator approval independent of the model, are not exploitable.

The signals are largely consistent toward high priority but with one important nuance. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.2 Critical: network reachable, no privileges, no user interaction, and total host impact. The key limiter is AT:P (attack requirements present) - exploitation is probabilistic because it depends on getting a crafted prompt to influence the agent and reliably coercing the model into forwarding non_interactive_mode through the batch tool, which is not guaranteed on every attempt. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or widespread exploitation; the risk is currently theoretical-but-serious rather than observed. The realistic priority is driven less by raw CVSS than by deployment context: any agent that exposes python_repl and the batch tool to untrusted or semi-trusted input (e.g., user chat, retrieved web content) is genuinely at risk of host RCE, while agents that don't enable python_repl are unaffected.

An attacker submits content that reaches the agent's context - for example a chat message, a document, or a web page the agent retrieves - containing a crafted instruction that tells the model to call the batch tool and invoke python_repl with non_interactive_mode passed as a keyword argument. The agent forwards the argument, the consent gate is bypassed, and attacker-chosen Python executes on the host with the agent process's privileges. No public POC is available in the provided data, and success is probabilistic (AT:P) because it depends on the model complying with the injected instruction.