CVE-2026-78379: Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon Strands Agents Tools python_repl toolto a version that resolves this vulnerability.Fixed in 0.8.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the python_repl tool in Amazon Strands Agents Tools versions earlier than 0.8.5 are affected. The issue concerns agents that process prompts from remote actors and run the tool on a host system.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a crafted prompt that causes non_interactive_mode to be forwarded as a keyword argument through the batch tool. No privileges or user interaction are required according to the provided severity vector.
What is the impact of successful exploitation?
Successful exploitation can bypass the human consent gate and allow arbitrary Python code execution on the agent host. This can affect confidentiality, integrity, and availability.
What is the recommended remediation?
Upgrade Amazon Strands Agents Tools to version 0.8.5 or later.