Loading story…
Amazon disclosed CVE-2026-12530, a high-severity command injection vulnerability in the AWS Bedrock AgentCore Python SDK. The flaw is caused by improper neutralization of argument delimiters in the install_packages() method, allowing a remote authenticated user to supply crafted package-name arguments and execute arbitrary commands inside the Code Interpreter sandbox.
The issue affects AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0 and is rated as remotely exploitable. AWS has published a security bulletin for the vulnerability, and the recommended mitigation is to upgrade affected deployments to version 1.6.1.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The published vulnerability guidance identifies upgrading the AWS Bedrock AgentCore Python SDK to version 1.6.1 as the recommended mitigation for CVE-2026-12530. This indicates a fixed version was made available for affected users.
Amazon published CVE-2026-12530, a high-severity command injection vulnerability in the AWS Bedrock AgentCore Python SDK's install_packages() method. The issue affects versions 1.1.3 through 1.6.0 and could allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS disclosed **CVE-2026-16796**, a high-severity command argument injection flaw in the Bedrock AgentCore Python SDK before version `1.18.1` that can let an authenticated user execute arbitrary commands inside the Code Interpreter sandbox. The issue affects the `install_packages()` function, where crafted Python package specifiers and improperly neutralized argument delimiters can be passed into a shell-backed `pip install` flow, resulting in **CWE-88** command injection. The vulnerability carries a **CVSS v3.1 score of 7.3** and can expose sensitive data in the sandbox, including temporary files and environment tokens, with potential for further movement in weakly segmented environments. AWS said the fix in version `1.18.1` tightens validation for package inputs, including PEP 508 extras, and quotes package arguments with `shlex.quote`; users are advised to upgrade immediately to the patched release.
Jul 25, 2026
Researchers disclosed multiple **Amazon Bedrock AgentCore** security issues that can break the isolation expected in AI agent execution environments. One finding showed that *AgentCore Code Interpreter* sandboxes allowed outbound **DNS** queries despite a no-network-access design, enabling attackers to create a bidirectional command-and-control channel, exfiltrate data over DNS, and obtain an interactive shell. The impact depends heavily on the IAM role attached to the runtime: overprivileged access could expose AWS resources such as **S3** and allow broader compromise of data and connected services. A separate Bedrock AgentCore issue, tracked as **`CVE-2026-4269`**, affected the *AgentCore Starter Toolkit* and allowed **unauthenticated remote code execution** through **S3 bucket squatting**. By registering a predictable bucket name before a victim's build process, an attacker could inject malicious content into the agent runtime, gain control of the execution environment, manipulate model inputs and outputs, and potentially achieve lateral movement based on the runtime's IAM permissions. The flaw also introduced a **software supply chain** risk because compromised dependencies could be cached or embedded into CI/CD artifacts and persist across later deployments.
Jun 29, 2026
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026