Amazon Strands-Agents-Tools vulnerabilities

2 CVEs affecting Amazon Strands-Agents-Tools, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78379, published 2026-08-25.

More from Amazon.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-78379, published 2026-08-25. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's…
• CVE-2026-15746, published 2026-07-15. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool…