CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools

unknownCVE-2026-18733

Bulletin ID: 2026-072-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 13:30 PM PDT Description: Strands Agents is an open-source SDK for building AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the shell tool for executing operating system commands on the agent's host. We identified CVE-2026-18733. The shell tool includes a human consent gate that prompts the operator to approve commands before they run. The tool also exposed a non_interactive parameter in the input schema that the large language model (LLM) could control. A crafted prompt, for example one delivered through untrusted content the agent reads (indirect prompt injection), could set non_interactive to true, which bypasses the consent gate and allows arbitrary operating system commands to execute on the agent's host without operator approval. Impacted versions: < 0.8.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-03
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-072-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-187330.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18733	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-18733: A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0…nvd

Recent advisories for - Prompt injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-70471: Flowise is a drag-and-drop user interface for building customized large language model (LLM) f…nvd · 2026-08-04
mediumCVE-2026-69704: Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate databas…nvd · 2026-08-04
mediumCVE-2026-66300: SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" r…nvd · 2026-08-04
unknownCVE-2026-64631: A vulnerability allowing a low-privileged user to inject SQL and extract database contents.nvd · 2026-08-04
unknownCVE-2026-18801: OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of c…nvd · 2026-08-04
highGHSA-6vh2-wg4h-4vwj: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `over…ghsa · 2026-08-04