CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools

unknownCVE-2026-18733

Bulletin ID: 2026-072-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 13:30 PM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the shell tool for executing operating system commands on the agent's host. We identified CVE-2026-18733. The shell tool includes a human consent gate that prompts the operator to approve commands before they run. The tool also exposed a non_interactive parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted content the agent reads (indirect prompt injection), could set non_interactive to true, which bypasses the consent gate and allows arbitrary operating system commands to execute on the agent's host without operator approval. Impacted versions: < 0.8.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Strands product: Agents Tools Code injection

What: Prompt injection vulnerability in the shell tool that bypasses human consent gate via the non_interactive parameter.
Who is affected: Strands Agents SDK users with the strands-agents-tools package, particularly those processing untrusted content.
Urgency: High; indirect prompt injection can bypass security controls and allow arbitrary command execution.
Action: Update strands-agents-tools to a patched version that removes or properly protects the non_interactive parameter.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Agents Tools

Get an email when a new Agents Tools advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-09-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-072-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-187330.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18733	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-18733: A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0…nvd

Recent advisories for - Prompt injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-89247: WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML inj…nvd · 2026-09-11
mediumCVE-2026-89246: WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula inj…nvd · 2026-09-11
highCVE-2026-18561: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via t…nvd · 2026-09-11
highCVE-2026-15462: The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_f…nvd · 2026-09-11
unknownCVE-2026-17176: An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent ne…nvd · 2026-09-11
highGHSA-4x45-gxvp-6283: @argos-ci/core: CI Branch Name OS Command Injectionghsa · 2026-09-10