Vulnerabilities CVE-2026-18733

CVE-2026-18733

High

Open

TLP:CLEAR

Prompt injection bypasses shell tool consent gate in Strands Agents Tools

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0.

Details

CVSS Score: 8.8
EPSS Score ⓘ: 0.32%

25.1th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Confidence: 90%
Published: Aug 3, 2026
Last Modified: Aug 4, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.