AI AgentHigh
CVE-2026-18733: A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might…
- Occurred
- Aug 3, 2026
- Published
- Aug 3, 2026
- Source
- NVD CVE
Summary
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0.
Tags
- CVE
- CVE-2026-18733
- cvss:HIGH
- agent-fail:injection-direct
- agent-fail:supervision
- agent-cause:missing-guardrail
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: Prompt injection vulnerability allows remote actors to bypass consent gates and execute arbitrary OS commands on agent host.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8