CVE-2026-16796 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Bulletin ID: 2026-065-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/23/2026 13:00 PM PDT
Description:
The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. We identified CVE-2026-16796, an improper neutralization of argument delimiters in the install_packages() method that might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
Impacted versions: bedrock-agentcore version <1.18.1
Resolution:
This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules, including constraining any extras group to comma-separated identifiers, before calling the SDK.
References:
Acknowledgement:
We would like to thank Sergio Garcia and BeyondTrust Phantom Labs for collaborating on this issue through the coordinated issue disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.