CVE-2026-12530: Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Synopsis

An argument-delimiter injection vulnerability in the install_packages() method of the AWS Bedrock AgentCore Python SDK (versions 1.1.3 through 1.6.0) allows a remote attacker with a low-privilege account to execute arbitrary commands inside the Code Interpreter sandbox by passing crafted package name strings. The attacker must reach the service over the network and trick a user into triggering the vulnerable call. Successful exploitation gives the attacker full read and write access to data within the sandbox environment. A patched-image rebuild at version 1.6.1 is available on HarborGuard for environments running an affected version of this SDK.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network; the CVSS vector specifies AV:N, meaning remote access to an exposed endpoint is necessary.

• AuthenticationRequired

  A low-privilege account is sufficient; the vector specifies PR:L, so the attacker must be authenticated but does not need administrative credentials.

• Victim interactionRequired

  A user must take an action that triggers the vulnerable install_packages() call, such as initiating a package installation with attacker-influenced input; the vector specifies UI:A.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental configuration to succeed.

Blast Radius

• Reads data accessible within the Code Interpreter sandbox, including files, environment variables, and any credentials or secrets mounted into that environment.
• Writes or modifies files and data within the sandbox, allowing persistent changes to the execution environment or staged artifacts.
• The host service and its availability are unaffected; the CVSS vector specifies VA:N and SA:N, so denial of service is not a direct outcome of this vulnerability.