AWS AgentCore CLI CVE-2026-11393: Brief Summary of a Critical Code Injection via Triple-Quote Escaping

Introduction

A code injection flaw in the AWS AgentCore CLI lets an authenticated user in an AWS account plant arbitrary Python code that later executes under another user's context in the same account. The code runs on that user's local development machine and on AWS AgentCore Runtime, where it has the imported agent's IAM role credentials. The flaw is tracked as CVE-2026-11393, with a CVSS score of 9.0. It exists because the CLI does not properly escape triple-quote characters when it generates Python source files during a Bedrock Agent import.

Amazon Bedrock AgentCore is AWS's managed platform for building, deploying, and operating AI agents at scale. It launched broadly in 2026 (with AWS GovCloud availability as of May 5, 2026) and handles infrastructure lifecycle management for agentic AI workloads. The AgentCore CLI (@aws/agentcore) is the primary developer interface for the platform. It is distributed through npm, with 48 published versions, and its source lives in the aws/agentcore-cli GitHub repository (164 stars, 46 forks).

Technical information

Vulnerability classification and root cause

CVE-2026-11393 falls under CWE-94: Improper Control of Generation of Code ('Code Injection'). MITRE defines this weakness as software that constructs code segments dynamically from external input without sufficiently neutralizing elements that could modify the intended control flow. The weakness requires that "the attacker can control the structure of the generated code."

When a developer runs agentcore add agent --type import to import a Bedrock supervisor agent, the CLI generates a main.py Python source file. In that step, the CLI interpolates the collaborationInstruction field from a Bedrock Agent collaborator association directly into a triple-quoted Python docstring (delimited by """).

The CLI applied single-quote escaping to the interpolated value instead of triple-quote escaping. In Python, only a matching """ sequence terminates a triple-quoted string. Escaping individual double quotes (as \") does not stop a """ sequence from closing the docstring. An attacker who controls the collaborationInstruction value can inject a literal """ to break out of the docstring. Python then interprets everything after it as executable statements, not string data.

Attack flow

Exploitation has three preconditions and five steps.

Preconditions:

1. The attacker must be an authenticated user in the same AWS account as the victim.
2. The attacker needs the bedrock:AssociateAgentCollaborator IAM permission, which lets them set or modify the collaborationInstruction value on a Bedrock Agent collaborator association.
3. The victim must later run agentcore add agent --type import with an affected CLI version.

Exploitation sequence:

1. The attacker crafts a collaborationInstruction that contains """ followed by arbitrary Python code (for example, code that imports os and executes system commands).
2. The attacker stores this instruction on a Bedrock Agent collaborator association through the bedrock:AssociateAgentCollaborator API.
3. When another user in the same AWS account imports the affected agent, the CLI reads the collaborationInstruction and interpolates it into the generated main.py docstring.
4. Because the CLI applies only single-quote escaping, the """ in the attacker's payload terminates the docstring. The Python code after the """ now sits outside the string literal and becomes executable code in the generated file.
5. The poisoned main.py executes in one of two contexts, depending on how the victim uses it.

Dual execution context

The injected code runs in two environments, and the security implications differ between them:

The two contexts set CVE-2026-11393 apart from the other AgentCore security findings documented by Unit 42 and Sonrai Security, which are cloud-only. Because the code also runs locally, a developer's workstation is directly in scope, along with all its stored credentials, source code, and network access.

Compounding risk: IAM privilege escalation

Findings from Unit 42 ("Agent God Mode") and Sonrai Security make the cloud execution path more severe. Unit 42 documented that AgentCore's auto-generated IAM execution roles grant wildcard resource access. Injected code running under one of these roles could access resources far beyond what the agent legitimately needs. AWS has since updated its documentation to warn that these auto-generated roles are "designed for development and testing purposes" and should "never be used in a production system." Organizations that have not implemented custom least-privilege roles remain exposed to the full blast radius of any code injection.

Affected systems and versions

These version ranges of the @aws/agentcore npm package are affected:

The CLI requires Node.js 20.x or later and is written primarily in TypeScript. Any environment where someone used an affected version of the CLI to import a Bedrock supervisor agent (agentcore add agent --type import) may contain a poisoned main.py file, even after the CLI itself is upgraded. Organizations should inventory all installed @aws/agentcore versions across development teams and CI/CD pipelines.

@padmak30 implemented the fix in pull request #1329. It was released on May 21, 2026, approximately 18 days before the NVD publication date of June 8, 2026, which is consistent with a coordinated disclosure process.

Vendor security history

Three independent research efforts have identified security weaknesses in the AgentCore platform within a relatively short timeframe, and CVE-2026-11393 is one of them:

Unit 42 responsibly disclosed the "Agent God Mode" finding to AWS on November 17, 2025. Its kill chain used the overly permissive default IAM roles to pull a target agent's Docker image from ECR, extract its MemoryID from environment files, and dump or poison its conversation history. Sonrai Security separately found that the Code Interpreter environment ships with the AWS CLI installed, so callers can execute any control plane action the execution role permits. Sonrai also found that "Sandbox" mode does not fully isolate S3 operations.

These findings follow a common pattern in rapid-release developer tooling: insufficient input sanitization in code generation paths, and permissive defaults that put developer experience ahead of security. AWS has responded promptly in each case. Still, the findings keep recurring, which suggests that organizations deploying AgentCore should assume more vulnerabilities may emerge and invest in defense-in-depth measures instead of relying only on point patches.

References

• AWS Security Bulletin 2026-040: CVE-2026-11393
• GitHub Advisory GHSA-m4x6-gwgp-4pm7
• AgentCore CLI v0.14.2 Release Notes
• @aws/agentcore v0.14.2 on npm
• @aws/agentcore v1.0.0-preview.9 on npm
• Amazon Bedrock AgentCore Product Page
• aws/agentcore-cli GitHub Repository
• CWE-94: Improper Control of Generation of Code ('Code Injection')
• Unit 42: Cracks in the Bedrock: Agent God Mode
• Sonrai Security: AWS AgentCore Privilege Escalation Path
• AWS Vulnerability Reporting