CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools
Remote attackers can execute arbitrary OS commands on the host by bypassing consent gates via prompt injection in Strands Agents Tools.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-18733?
CVE-2026-18733 is a high-severity command injection vulnerability in AWS strands-agents-tools, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate.
To remediate this issue, users should upgrade to version 0.8.0.
Weakness: CWE-1427
Which versions are affected by CVE-2026-18733?
How do I fix CVE-2026-18733?
No fix has been published for CVE-2026-18733 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-18733 being exploited?
There is no known exploitation of CVE-2026-18733 in the wild and no public exploit code.
Sources
Also known as GHSA-mqvc-p852-wf8x.