PT-2026-67502 · Amazon · Strands-Agents-Tools

CVE-2026-18733

·

Published

2026-08-03

·

Updated

2026-08-04

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.0
Description A prompt injection issue in the shell tool allows remote actors to execute arbitrary operating system commands on the agent host. This is achieved by using a crafted prompt that sets the non interactive parameter to true, which bypasses the human consent gate.
Recommendations Upgrade to version 0.8.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1427

Related Identifiers

CVE-2026-18733
GHSA-MQVC-P852-WF8X

Affected Products

Strands-Agents-Tools