High severity · published Jun 17, 2026
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.
To mitigate this issue, users should upgrade to version 1.6.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
bedrock-agentcore · AWS
1.1.3 before 1.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12530
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12530
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-044-aws/
pypi.org
https://pypi.org/project/bedrock-agentcore/1.6.1/
More from bedrock-agentcore
5.7
CVE-2026-15737
Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK