CVE-2026-11393

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11393", "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "state": "PUBLISHED", "assignerShortName": "AMZN", "dateReserved": "2026-06-05T16:15:22.377Z", "datePublished": "2026-06-08T18:38:03.960Z", "dateUpdated": "2026-06-08T19:45:58.413Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "shortName": "AMZN", "dateUpdated": "2026-06-08T18:49:55.513Z"}, "title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242: Code Injection"}]}], "affected": [{"vendor": "AWS", "product": "AgentCore CLI", "versions": [{"status": "affected", "version": "0.4.0", "lessThanOrEqual": "0.14.1", "versionType": "custom"}, {"status": "affected", "version": "0.3.0-preview.7.0", "lessThanOrEqual": "1.0.0-preview.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.4.0", "versionEndIncluding": "0.14.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.3.0-preview.7.0", "versionEndIncluding": "1.0.0-preview.8"}]}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted <code>collaborationInstruction</code> stored on a Bedrock Agent collaborator and later processed by that other user during agent import.</p><p>To remediate this issue, users should upgrade to version 0.14.2.</p>"}]}], "references": [{"url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2", "tags": ["patch"]}, {"url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2", "tags": ["patch"]}, {"url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9", "tags": ["patch"]}, {"url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T19:45:52.025563Z", "id": "CVE-2026-11393", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T19:45:58.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11393", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T19:45:52.025563Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T19:45:54.794Z"}}], "cna": {"title": "Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242: Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AWS", "product": "AgentCore CLI", "versions": [{"status": "affected", "version": "0.4.0", "versionType": "custom", "lessThanOrEqual": "0.14.1"}, {"status": "affected", "version": "0.3.0-preview.7.0", "versionType": "custom", "lessThanOrEqual": "1.0.0-preview.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2", "tags": ["patch"]}, {"url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2", "tags": ["patch"]}, {"url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9", "tags": ["patch"]}, {"url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted <code>collaborationInstruction</code> stored on a Bedrock Agent collaborator and later processed by that other user during agent import.</p><p>To remediate this issue, users should upgrade to version 0.14.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.14.1", "versionStartIncluding": "0.4.0"}, {"criteria": "cpe:2.3:a:aws:agentcore_cli:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.0.0-preview.8", "versionStartIncluding": "0.3.0-preview.7.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "shortName": "AMZN", "dateUpdated": "2026-06-08T18:49:55.513Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11393", "state": "PUBLISHED", "dateUpdated": "2026-06-08T19:45:58.413Z", "dateReserved": "2026-06-05T16:15:22.377Z", "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "datePublished": "2026-06-08T18:38:03.960Z", "assignerShortName": "AMZN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "AgentCore CLI", "vendor": "AWS", "versions": [{"lessThanOrEqual": "0.14.1", "status": "affected", "version": "0.4.0", "versionType": "custom"}, {"lessThanOrEqual": "1.0.0-preview.8", "status": "affected", "version": "0.3.0-preview.7.0", "versionType": "custom"}]}], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import.\n\n\n\nTo remediate this issue, users should upgrade to version 0.14.2."}, {"lang": "es", "value": "La neutralizaci\u00f3n incorrecta de caracteres de triple comilla durante la generaci\u00f3n de c\u00f3digo Python en AgentCore CLI antes de la v0.14.2 podr\u00eda permitir que un actor de amenaza remoto autenticado ejecute c\u00f3digo arbitrario en el tiempo de ejecuci\u00f3n de AWS AgentCore bajo el rol de ejecuci\u00f3n de IAM del agente importado y en el entorno local de otro usuario en la misma cuenta de AWS, a trav\u00e9s de una collaborationInstruction especialmente dise\u00f1ada almacenada en un colaborador de Bedrock Agent y procesada posteriormente por ese otro usuario durante la importaci\u00f3n del agente.\n\nPara remediar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n 0.14.2."}], "id": "CVE-2026-11393", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11393", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T19:45:52.025563Z", "version": "2.0.3"}}]}, "published": "2026-06-08T19:16:41.270", "references": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "url": "https://aws.amazon.com/security/security-bulletins/2026-040-aws/"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "url": "https://github.com/aws/agentcore-cli/releases/tag/v0.14.2"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "url": "https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "url": "https://www.npmjs.com/package/@aws/agentcore/v/0.14.2"}, {"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "url": "https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9"}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,0.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.3.0-preview.7.0,1.0.0-preview.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "AgentCore CLI", "source": "cna", "vendor": "AWS"}, "product": "agentcore_cli", "vendor": "aws"}], "created": "2026-06-08T20:30:06.735293+00:00", "updated": "2026-06-09T08:56:37.451843+00:00", "vendors": ["aws", "aws$PRODUCT$agentcore_cli"]}