Intelligence
Join the waitlist
AEV-2026-0003

Strands Agents Tools shell consent gate skippable by the model (CVE-2026-18733)

AWS Strands Agents Tools shipped a shell tool whose human consent gate was skipped when a model settable non_interactive parameter was true, letting crafted input run arbitrary operating system commands with the agent process's privileges. Disclosed by AWS, patched in 0.8.0, with no evidence of exploitation.

AESS 8.1 highConfirmedStatus: resolvedEvent: 3 August 2026Approval ControlsExecution Authority

Affected

Organisation
AWS
Product
Strands Agents Tools
Component
shell tool consent gate (non_interactive parameter)
Versions
Versions before 0.8.0; fixed in 0.8.0
Configurations
Agent exposed to untrusted content that can influence tool parameters

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
An agent running operating system commands through the shell tool
Agent
An agent built on the Strands Agents SDK
Delegating actor
The operator running the agent
Action
Set non_interactive to true so the consent gate did not fire, then ran an operating system command
Target resource
The host the agent process runs on
Environment
Wherever the agent process executes
Credentials used
unknown
Privileges available
The privileges of the agent process
Authority presented
A tool call that also carried the parameter governing its own approval
Authority required
Operator consent to run the command
Applicable policy
The human consent gate on the shell tool
Approval mechanism
A consent gate the operator was meant to satisfy
Required approver
The operator
Independent approval
no
Action binding
The gate's enabling condition was a model controllable field, not operator set
Sequence context
Indirect prompt injection in content the agent read could set the parameter before the command ran

Impact

Consequence
Arbitrary operating system commands run with the agent process's privileges
Reach
The host the agent runs on
Reversibility
unknown
Detectability
Silent: the consent gate did not fire
Propagation
unknown
Recovery
Fixed by removing the parameter from the model facing schema and reading it from an environment variable

Evidence

Primary sources

Supporting sources

Reproduction status
Confirmed and patched by AWS; CVSS 3.1 base 8.8 in the GitHub advisory
Evidence state
Confirmed

Known unknowns

  • Whether any deployment was affected before the patch.

Limitations

  • No evidence in AWS's advisories, GitHub's advisories or public reporting that it was exploited against a real deployment.
  • Three sibling CVEs in the same package address a related shape in credential scope, tenant isolation and connection configuration and are recorded on the source record rather than folded in here.

Claim provenance