Beyondtrust

**Name of the Vulnerable Software and Affected Versions** AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0 **Description** Improper neutralization of argument delimiters in the `install packages()` method of the Code Interpreter client allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox. The method constructs a 'pip install' shell command using package name arguments provided by the caller but employs an incomplete blocklist. This allows crafted arguments, specifically pip flags such as `--index-url` and `-r`, to bypass validation. An attacker could use this to redirect package resolution to a third-party-controlled PyPI server or expose environment variables and arbitrary sandbox files. **Recommendations** Upgrade to version 1.6.1. As a temporary workaround, avoid passing user-supplied or externally-influenced strings directly to the `install packages()` method and restrict calls to a fixed, hardcoded list of approved package names.