CVE-2026-11393

Name of the Vulnerable Software and Affected Versions AgentCore CLI versions prior to 0.14.2

Description Improper neutralization of triple-quote characters during Python code generation allows an authenticated remote actor to execute arbitrary code. This occurs when a crafted collaborationInstruction stored on a Bedrock Agent collaborator is processed by another user during agent import. The execution can take place on the AWS AgentCore Runtime under the imported agent's IAM execution role or within the local environment of another user in the same AWS account.

Recommendations Upgrade to version 0.14.2.