Answer in brief
CVE-2026-11393 records a High severity rce vulnerability in AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Answer in brief
CVE-2026-11393 records a High severity rce vulnerability in AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Update @aws/agentcore to 0.14.2; @aws/agentcore to 1.0.0-preview.9 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanRCE describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-11393 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @aws/agentcorenpm | >=0.4.0,<0.14.2 | 0.14.2 |
| @aws/agentcorenpm | >=0.3.0-preview.7.0,<=0.3.0-preview.9.0 | Not reported |
| @aws/agentcorenpm | >=1.0.0-preview.1,<1.0.0-preview.9 | 1.0.0-preview.9 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-11393 records a High severity rce vulnerability in AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @aws/agentcore, @aws/agentcore, @aws/agentcore.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @aws/agentcore to 0.14.2; @aws/agentcore to 1.0.0-preview.9 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanRCE describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-11393 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @aws/agentcorenpm | >=0.4.0,<0.14.2 | 0.14.2 |
| @aws/agentcorenpm | >=0.3.0-preview.7.0,<=0.3.0-preview.9.0 | Not reported |
| @aws/agentcorenpm | >=1.0.0-preview.1,<1.0.0-preview.9 | 1.0.0-preview.9 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-11393 records a High severity rce vulnerability in AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @aws/agentcore, @aws/agentcore, @aws/agentcore.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the `agentcore add agent --type import` command, resulting in arbitrary code execution when the generated file is loaded or deployed. ### Impact When a user runs `agentcore add agent --type import` to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python statements into the generated source file. An authenticated AWS user in the same account with the bedrock:AssociateAgentCollaborator IAM permission can associate a collaborator agent carrying a crafted collaborationInstruction with a supervisor agent. A developer who subsequently imports that supervisor agent using an affected CLI version will have the injected code written to their local main.py of the imported agent. The injected code executes in two contexts: on the developer's local machine when running `agentcore dev`, under the developer's local AWS credentials; and in the AWS AgentCore Runtime environment when the developer runs `agentcore deploy` followed by agentcore invoke, under the agent's IAM execution role. Customers who have already imported a supervisor agent using an affected version and deployed it to AWS remain exposed on every agent invocation until they regenerate and redeploy the agent using a patched CLI version. **Impacted versions:** @aws/agentcore >= 0.4.0 AND <= 0.14.1, preview >= 0.3.0-preview.7.0 AND <= 1.0.0-preview.8 ### Patches This issue has been addressed in AgentCore CLI version 0.14.2 and preview version 1.0.0-preview.9. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers who have previously run `agentcore add agent --type import` on an affected version must also remove the affected agent from their project, re-run the import with the patched CLI to regenerate a clean main.py for the imported agent, and redeploy their agent to AWS to replace the previously deployed artifact. Upgrading the CLI alone does not remediate already-generated or already-deployed code. ### Workarounds If an immediate upgrade is not possible, customers can manually inspect the generated main.py of the imported agent for any collaboratorInstruction values that contain triple double-quote character sequences and replace each occurrence with escaped equivalents before running `agentcore dev` or `agentcore deploy`. ### References If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.
### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where, under certain circumstances, a crafted collaborationInstruction value stored in Bedrock Agent collaborator metadata can break out of a Python triple-quoted string in code generated by the `agentcore add agent --type import` command, resulting in arbitrary code execution when the generated file is loaded or deployed. ### Impact When a user runs `agentcore add agent --type import` to import a Bedrock supervisor agent that has multi-agent collaboration enabled, the CLI fetches collaborator metadata from the Bedrock API and interpolates the collaborationInstruction field directly into a triple-quoted Python string in the generated main.py file of the imported agent. Due to insufficient escaping, a collaborationInstruction value containing triple double-quote characters can terminate the string boundary and inject arbitrary Python statements into the generated source file. An authenticated AWS user in the same account with the bedrock:AssociateAgentCollaborator IAM permission can associate a collaborator agent carrying a crafted collaborationInstruction with a supervisor agent. A developer who subsequently imports that supervisor agent using an affected CLI version will have the injected code written to their local main.py of the imported agent. The injected code executes in two contexts: on the developer's local machine when running `agentcore dev`, under the developer's local AWS credentials; and in the AWS AgentCore Runtime environment when the developer runs `agentcore deploy` followed by agentcore invoke, under the agent's IAM execution role. Customers who have already imported a supervisor agent using an affected version and deployed it to AWS remain exposed on every agent invocation until they regenerate and redeploy the agent using a patched CLI version. **Impacted versions:** @aws/agentcore >= 0.4.0 AND <= 0.14.1, preview >= 0.3.0-preview.7.0 AND <= 1.0.0-preview.8 ### Patches This issue has been addressed in AgentCore CLI version 0.14.2 and preview version 1.0.0-preview.9. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers who have previously run `agentcore add agent --type import` on an affected version must also remove the affected agent from their project, re-run the import with the patched CLI to regenerate a clean main.py for the imported agent, and redeploy their agent to AWS to replace the previously deployed artifact. Upgrading the CLI alone does not remediate already-generated or already-deployed code. ### Workarounds If an immediate upgrade is not possible, customers can manually inspect the generated main.py of the imported agent for any collaboratorInstruction values that contain triple double-quote character sequences and replace each occurrence with escaped equivalents before running `agentcore dev` or `agentcore deploy`. ### References If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.