CVE-2026-16796: Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Summary
The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the installpackages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
Impact Insufficient input validation in installpackages() allows specially crafted package specifiers to bypass validation and achieve arbitrary command execution within the sandbox. A remote authenticated user who can influence the arguments to installpackages() can execute arbitrary commands within the Code Interpreter sandbox environment.
Impacted Versions < 1.18.1
Patches This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds If you are not able to upgrade, do not pass untrusted or model-generated input to installpackages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers -- before calling the SDK.
References If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Acknowledgement
AWS would like to thank Sergio Garcia (@MrCloudSec) for collaborating on this issue through the coordinated issue disclosure process.
Other sources
Improper neutralization of argument delimiters in the installpackages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue, users should upgrade to the patched version 1.18.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/bedrock-agentcoreto a version that resolves this vulnerability.Fixed in 1.18.1 - Upgrade
Upgrade
bedrock-agentcoreto a version that resolves this vulnerability.Fixed in 1.18.1 - Configuration
When calling install_packages(), validate any dynamic package/specifier inputs against strict PyPI naming rules—especially constrain any extras group to comma-separated identifiers—before passing them to the SDK.
Code Interpreter client (bedrock-agentcore) install_packages() Input validation for package name arguments = Validate dynamic package names against strict PyPI naming rules, including constraining any extras group to comma-separated identifiers - Compensating control
If you cannot upgrade, do not pass untrusted or model-generated input to install_packages() (only supply trusted, non-user-controlled package arguments).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16796?
The severity of CVE-2026-16796 is rated as high, with a score of 7.3.
How do I fix CVE-2026-16796?
To fix CVE-2026-16796, ensure that you upgrade to AWS Bedrock AgentCore Python SDK version 1.18.1 or later.
What vulnerabilities are associated with CVE-2026-16796?
CVE-2026-16796 allows remote authenticated users to execute arbitrary commands within the Code Interpreter sandbox.
Who is affected by CVE-2026-16796?
Users of AWS Bedrock AgentCore Python SDK versions before 1.18.1 are affected by CVE-2026-16796.
What type of vulnerability is CVE-2026-16796?
CVE-2026-16796 is classified as an improper neutralization of argument delimiters vulnerability.