CVE-2026-11393: Code Injection via Improper Triple-Quote Escaping in AWS AgentCore CLI

The AWS AgentCore CLI (@aws/agentcore) is a development framework designed to streamline the modeling, translation, and deployment of multi-agent architectures on Amazon Bedrock. It functions as a local code generation tool, translating cloud-side configurations of Bedrock Agents into programmatic frameworks such as LangGraph or Strands. This translation bridge creates a unique attack surface where metadata defined on remote cloud resources is parsed and written directly into local execution scripts.

Under normal operations, a developer pulls agent definitions from AWS using the CLI command agentcore add agent --type import. This command queries the Bedrock API to retrieve agent definitions, including collaborator agent hierarchies and metadata. The threat vector arises because these configurations, once defined in the cloud, are treated as semi-trusted structures during code translation, creating a bridge for malicious input to cross from the control plane into the developer's execution environment.

The underlying bug class is an improper control of generation of code (CWE-94), manifesting specifically as a Python triple-quote docstring escape. If an adversary gains access to edit collaborator agent settings (such as the collaborationInstruction field), they can structure payloads that manipulate the CLI's file-writing routines. The resulting file, when executed on a workstation or a continuous integration (CI) runner, compromises the confidentiality, integrity, and availability of the execution context.

The scope of potential exposure spans across enterprise environments leveraging Bedrock Multi-Agent systems. Since collaborator definitions are shared globally or contextually within an AWS account, any developer working on the same agent infrastructure becomes an implicit target. The vulnerability bridges the gap between cloud infrastructure configuration and local system compromise, bypassing traditional boundary protections.

The flaw is localized within the translation subsystem of the AgentCore CLI, specifically inside the BaseBedrockTranslator class. During the conversion process, the CLI parses the Bedrock Agent's collaborators to build programmatic wrappers. To describe these collaborators to the agent runtime, the translator constructs inline metadata records formatted as Python dictionaries and places them within function docstrings.

In affected versions, the mapping function for collaborator descriptions utilized BaseBedrockTranslator.escapePySingleQuote() to neutralize user-supplied text. This helper function is designed exclusively to escape single quotes (') by prepending a backslash (\'). However, it contains no logic to process, modify, or escape double quotes (") or sequences of double quotes, such as the triple-double-quote identifier (""").

Python uses triple-double-quotes (""") as a standard delimiter for multi-line strings and function docstrings. Because the translator directly interpolates the collaborationInstruction property inside a python docstring template, the failure to escape triple-double-quotes allows an attacker to control the string boundary. This syntax breakout terminates the string literal prematurely, enabling the execution of arbitrary Python commands that follow.

To understand the execution environment, we must evaluate the structure of generated code. The CLI generates helper functions with specific docstring decorations that contain the raw unsanitized payload. When the Python interpreter loads this module, it parses the injected commands as active code statements rather than literal string comments. This parsing mismatch is the root catalyst for the remote code execution chain.

The vulnerable code path is illustrated by analyzing the translation mapping function in base-translator.ts. In this file, the collaboratorDescriptions property is compiled by mapping over the array of collaborators. The code uses template literals to assemble a Python dictionary string, relying on the weak single-quote escaping function.

Below is a side-by-side comparison illustrating the vulnerable implementation versus the patched implementation.

// VULNERABLE CODE in base-translator.ts (pre-v0.14.2)
this.collaboratorDescriptions = this.collaborators.map(
  c =>
    `{'agentName': '${BaseBedrockTranslator.escapePySingleQuote(c.agent?.agentName ?? '')}', 'collaboratorName': 'invoke_${sanitizePyIdentifier(c.collaboratorName ?? '')}', 'collaboratorInstruction': '${BaseBedrockTranslator.escapePySingleQuote(c.collaborationInstruction ?? '')}'}`
);
 
// PATCHED CODE in base-translator.ts (v0.14.2+)
this.collaboratorDescriptions = this.collaborators.map(
  c =>
    `{'agentName': '${BaseBedrockTranslator.escapePySingleQuote(c.agent?.agentName ?? '')}', 'collaboratorName': 'invoke_${sanitizePyIdentifier(c.collaboratorName ?? '')}', 'collaboratorInstruction': '${BaseBedrockTranslator.escapePyTripleQuote(c.collaborationInstruction ?? '')}'}`
);

The patch replaces escapePySingleQuote with escapePyTripleQuote specifically for the collaborationInstruction field. This new function searches for instances of triple quotes and converts them into escaped sequences. Because the generated python docstring uses triple quotes as its delimiter, escaping these sequences with backslashes stops the Python interpreter from terminating the string context.

Analysis of the fix indicates that it is technically complete for the identified attack vector inside docstrings. However, security teams must ensure that any other fields generated inside similar multi-line Python block structures also undergo strict escaping. If other parameters, such as agentName, are ever moved from single-quoted dictionary keys to multi-line string assignments, they would require the same rigorous triple-quote escaping.

To execute this attack, an adversary must possess privileges to alter Bedrock Agent collaborator metadata or configure a malicious collaborator agent. This role typically requires low-privileged authenticated access to the AWS Console or the Bedrock API endpoint. The attacker targets the collaborationInstruction parameter of the collaborator configuration.

The attacker injects a string payload that closes the docstring context, injects the malicious code, and then creates a dummy docstring opening to keep the rest of the generated template syntactically valid. A standard payload structures the input with triple-double-quotes, a newline, the target system commands, and an opening triple-double-quote sequence.

The process of execution relies on the victim running the local CLI utility. When the developer invokes the import command, the CLI pulls down the configured collaborator parameters from AWS and generates the Python file with the injected payload. The payload is triggered as soon as the Python environment parses or imports the generated file, executing the commands with the local privileges of the developer.

Below is a representation of the execution flow from configuration to execution:

The direct consequence of exploiting CVE-2026-11393 is arbitrary code execution. This code execution is not confined to sandboxed environments; it runs natively on the machine executing the compiled scripts. In a local development scenario, the payload inherits the full operating system privileges of the developer, exposing access to SSH keys, local credentials, source code repositories, and environment variables.

If the generated codebase is integrated into a continuous integration / continuous deployment (CI/CD) pipeline, the impact propagates to build agents. Malicious Python scripts executing during standard testing or build phases can compromise pipeline secrets, allowing attackers to perform lateral movement within the enterprise cloud infrastructure.

Furthermore, if the code is deployed back into the cloud under the AWS AgentCore Runtime, the payload executes within the serverless or containerized runtime environment. This grants the attacker immediate access to the temporary security credentials of the Bedrock Agent's IAM execution role, potentially allowing them to read, write, or delete sensitive cloud resources depending on the role's scope of authorization.

The CVSS vector breakdown assigns high severity due to the potential for complete system compromise. The attack complexity is low because no complex race conditions or memory layouts are required to bypass control protections. Security operations centers must evaluate the exposure of developer workstations as prime targets for lateral enterprise escalation.

The primary and recommended remediation strategy is to upgrade @aws/agentcore CLI to a secure version. For stable channels, users must upgrade to version 0.14.2 or later. For teams leveraging the preview channels, the fix is available starting with version 1.0.0-preview.9. Upgrading modifies the translation routines to use the secure escapePyTripleQuote escaping algorithm automatically.

If an immediate upgrade is not feasible, organizations must implement strict access controls on Bedrock Agent configuration permissions. Specifically, IAM policies should restrict write operations such as bedrock:CreateAgent, bedrock:UpdateAgent, and bedrock:UpdateAgentCollaborator to authorized security administrators, minimizing the surface of potential internal or compromised actors who can stage the payload.

Additionally, security teams can scan local source repositories and generated output folders for indicators of compromise. Run a localized search for unescaped triple-double-quotes inside metadata definitions within Python scripts. Organizations can also monitor AWS CloudTrail logs for unexpected modifications to agent collaborator structures, specifically looking for multi-line text or system call signatures in collaborator instruction parameters.

Post-incident response should include invalidating any local environment credentials or SSH keys exposed on development workstations during the window of vulnerability. Automated configuration management tools can enforce the deployment of the updated CLI version across all enterprise developer systems to maintain a uniform security posture.