AWS's AgentCore SDK needed two releases to close one injection bug in install_packages()

`install_packages()` exists so an agent can add libraries at runtime inside AgentCore's isolated Code Interpreter sandbox ^[1]. A dev.to post that traced both rounds published a simplified version of the code ^[3]. The helper joins the caller's strings with spaces, formats them into `pip install {pkg_str}`, and hands the line to `run_in_sandbox()` as one command string ^[3]. Every character of a package name reaches the shell, delimiters included ^[3]. The weakness class is CWE-88, argument injection ^[5].

A validation fix has to anticipate every form pip accepts as a package name. That grammar includes the bracketed extras form, `package[extra1,extra2]` ^[7]. Round two came through that form, in the same function and the same sink as round one, according to the post ^[7].

The v1.18.1 change combines shlex-based quoting with a tighter allowlist on which extras syntax is permitted, according to the post's reading of the linked commit and BeyondTrust's write-up ^[9]. I think that is the right design. Quoting makes the shell see each name as one argument whatever it contains. The allowlist limits what pip is asked to resolve. "That is the correct shape: parse, don't concatenate," the author wrote ^[10]. In the snippet, the sandbox call takes a single string ^[3]. If the real API accepts nothing else, quoting is the fix on offer, since there is no argument vector to pass.

The post opens with a stronger line. "Both fixes were bypassable, each in a different way," the author wrote ^[2]. The detail that follows documents one fix being bypassed, the extras route around the first, and endorses the v1.18.1 design ^[7][10]. The post does not describe a bypass of v1.18.1, so the evidence supports two rounds of one bug with the second fix still standing ^[9].

The CVSS vectors behind the NVD scores cap impact at the sandbox boundary ^[12]. The first advisory adds that a crafted name could point pip at an attacker-controlled package index and expose sandbox files and environment variables ^[13]. BeyondTrust titled its research "Package Name to Role Credentials in Code Interpreter", a chain the post's author has not reproduced ^[14]. The firm also published a companion repository, agentcore-sandbox-breakout, demonstrating DNS and S3 exfiltration paths from the same sandboxes ^[15].

For CI, the author runs a preflight script that exits 1 when the installed SDK sits in a vulnerable range ^[16]. Its table marks CVE-2026-12530 as affecting 1.1.3 up to 1.6.1, and CVE-2026-16796 as affecting everything below 1.18.1 with no lower bound ^[16]. Its `version_tuple()` casts each of the first three dot-separated segments to an integer ^[17]. A pre-release string such as 1.18.1rc1 would raise ValueError and stop the job, so the gate fails closed ^[2].