1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
aws-agentcore
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 3 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting aws-agentcore, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-m4x6-gwgp-4pm7 | High | AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the `agentcore add agent --type import` command, resulting in arbitrary code execution when the generated file is loaded or deployed. ### Impact When a user runs `agentcore add agent --type import` to import a Bedrock supervisor agent that has multi-ag |
| GitHub (opens in a new tab) |
- GHSA-m4x6-gwgp-4pm7HighAgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping
>= 0.4.0, < 0.14.2>= 0.3.0-preview.7.0, <= 0.3.0-preview.9.0- +1 more
Affected versions:>= 0.4.0, < 0.14.2>= 0.3.0-preview.7.0, <= 0.3.0-preview.9.0>= 1.0.0-preview.1, < 1.0.0-preview.9
### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the `agentcore add agent --type import` command, resulting in arbitrary code execution when the generated file is loaded or deployed. ### Impact When a user runs `agentcore add agent --type import` to import a Bedrock supervisor agent that has multi-ag
CVE: CVE-2026-11393