CyberRota Analysis
AI-GeneratedThe python_repl tool in Amazon Strands Agents Tools prior to version 0.8.5 is vulnerable to arbitrary code execution due to improper input handling, allowing remote actors to bypass consent mechanisms through crafted prompts. This vulnerability poses a significant risk to systems utilizing this tool, as it can lead to unauthorized execution of Python code on the host. Organizations using affected versions should prioritize upgrading to version 0.8.5 or later to mitigate this high-severity threat.
Original NVD Description
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0.8.5 or later.