CVE-2026-18733
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate.
Risk Assessment
A remote attacker can execute arbitrary system commands on the agent host, potentially leading to full system and data compromise.
Recommendation
Upgrade to version 0.8.0, which contains the fix.
Other vulnerabilities in Amazon Strands Agents Tools
See all- CVE-2026-78379High
The python_repl tool in Amazon Strands Agents Tools before 0.8.5 has improper neutralization of input used for LLM prompting, allowing remote attackers to bypass the human consent gate and execute arbitrary Python code on the agent's host by forwarding non_interactive_mode as a keyword argument through the batch tool. This issue is fixed in version 0.8.5.
- CVE-2026-19111High
Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3. Remote authenticated users can access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter.
Original NVD description (English source)
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0.