---
id: CVE-2026-16796
aliases:
  - GHSA-j6g5-3hh3-pgw8
title: >-
  AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the
  Python SDK install_packages()
summary: >-
  AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the
  Python SDK install_packages()
severity: high
cvss: 7.3
cwe:
  - CWE-88
vendor: bedrock-agentcore
product: bedrock-agentcore
ecosystem: pip
affected:
  - bedrock-agentcore < 1.18.1
patched:
  - bedrock-agentcore 1.18.1
published: '2026-07-24'
updated: '2026-07-24'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-j6g5-3hh3-pgw8'
references:
  - url: >-
      https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16796'
  - url: 'https://github.com/aws/bedrock-agentcore-sdk-python/pull/581'
  - url: >-
      https://github.com/aws/bedrock-agentcore-sdk-python/commit/3c4b4ee6b8730e6313a82c743ac37dbcc1c21cdb
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-065-aws'
  - url: 'https://pypi.org/project/bedrock-agentcore/1.18.1'
  - url: 'https://github.com/advisories/GHSA-j6g5-3hh3-pgw8'
tags:
  - ghsa
  - pip
epss: 0.00725
epssPercentile: 0.52674
ingestedAt: '2026-07-24T22:40:26.272Z'
---

## Overview

### Summary

The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the install_packages() method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

### Impact
Insufficient input validation in install_packages() allows specially crafted package specifiers to bypass validation and achieve arbitrary command execution within the sandbox. A remote authenticated user who can influence the arguments to install_packages() can execute arbitrary commands within the Code Interpreter sandbox environment.

### Impacted Versions
< 1.18.1

### Patches
This issue has been addressed in bedrock-agentcore version 1.18.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

### Workarounds
If you are not able to upgrade, do not pass untrusted or model-generated input to install_packages(). Applications that must accept dynamic package names should validate them against strict PyPI naming rules -- including constraining any extras group to comma-separated identifiers -- before calling the SDK.

### References
If you have any questions or comments about this advisory, AWS asks that you contact AWS Security via the [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

### Acknowledgement

AWS would like to thank Sergio Garcia (@MrCloudSec) for collaborating on this issue through the coordinated issue disclosure process.

## Affected packages

- `bedrock-agentcore < 1.18.1`

## Remediation

Upgrade to a patched release:

- `bedrock-agentcore 1.18.1`