CVE-2026-78379

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

CVE-2026-78379: Undefined Security Weakness

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

PT-2026-68680

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.3 Description An insecure direct object reference exists in the mongodb memory, elasticsearch memory, and mem0 memory tools. Remote authenticated users can access, modify, or delete memories...

CVE-2026-19111: Authorization Bypass Through User-Controlled Key

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-18733: Undefined Security Weakness

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...