CVE-2026-11393 json
Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
published 2026-06-08 5 mo ago modified 2026-07-29 3 mo ago also GHSA-m4x6-gwgp-4pm7 , EUVD-2026-35187
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.
To remediate this issue, users should upgrade to version 0.14.2.
Patch / fix
- npm @aws/agentcore 0.14.2, 1.0.0-preview.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @aws/agentcore | >=0.4.0, <0.14.2 >=0.3.0-preview.7.0, <=0.3.0-preview.9.0 >=1.0.0-preview.1, <1.0.0-preview.9 |
0.14.2 1.0.0-preview.9 |
Affected products
- AWS AgentCore CLI
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/aws/agentcore-cli/releases/tag/v0.14.2
patch, web
-
npmjs.com
/package/@aws/agentcore/v/0.14.2
patch, web
-
npmjs.com
/package/@aws/agentcore/v/1.0.0-preview.9
patch, web
-
github.com
/aws/agentcore-cli/pull/1329
web
-
github.com
/aws/agentcore-cli/commit/ae1b932ec91bacdbb7a3521f9f1fc24479a3d504
web
-
aws.amazon.com
/security/security-bulletins/2026-040-aws/
vendor-advisory
-
github.com
/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-11393
advisory
-
aws.amazon.com
/security/security-bulletins/2026-040-aws
web
-
github.com
/aws/agentcore-cli
package
Sources
- CVE List CVE-2026-11393
- GitHub Advisory GHSA-m4x6-gwgp-4pm7
- NVD CVE-2026-11393
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.