CVE-2026-12530

Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions 1.1.3 through 1.6.0

Description Improper neutralization of argument delimiters in the install packages() method of the Code Interpreter client allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox. The method constructs a 'pip install' shell command using package name arguments provided by the caller but employs an incomplete blocklist. This allows crafted arguments, specifically pip flags such as --index-url and -r, to bypass validation. An attacker could use this to redirect package resolution to a third-party-controlled PyPI server or expose environment variables and arbitrary sandbox files.

Recommendations Upgrade to version 1.6.1. As a temporary workaround, avoid passing user-supplied or externally-influenced strings directly to the install packages() method and restrict calls to a fixed, hardcoded list of approved package names.