Two RCE CVEs disclosed for the Code Interpreter assistant in the Amazon Bedrock AgentCore Python SDK

BeyondTrust Phantom Labs' Sergio Garcia discovered two remote code execution vulnerabilities in the install_packages() helper of the Amazon Bedrock AgentCore Python SDK. An attacker only needs to influence the passed package name to execute commands inside the Code Interpreter sandbox and read the AWS credentials of the bound execution role. The first vulnerability, CVE-2026-12530, exploits a newline character in the package name to bypass a five-character blacklist, affecting bedrock-agentcore v1.1.3 through v1.6.0. After AWS switched to a regex whitelist in v1.6.1, the researchers bypassed it again via command substitution in pip extras syntax, resulting in CVE-2026-16796, affecting v1.6.1 through v1.18.0.