Aws Strands-Agents-Tools vulnerabilities

2 CVEs affecting Aws Strands-Agents-Tools, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19111, published 2026-08-06.

More from Aws.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-18733, published 2026-08-03. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a…
• CVE-2026-19111, published 2026-08-06. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access,…