Bulletin ID: 2026-127-AWSScope: AWSContent Type: Important (requires attention)Publication Date: 10/06/2026 13:30 PM PDTDescription:bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into local development environments. We identified CVE-2026-105812, a code injection issue that could allow arbitrary code execution when a specially crafted agent is imported and subsequently run or deployed, and CVE-2026-106032, an external reference handling issue that could cause unintended network requests or local file access during agent import.Affected versions: >= 0.1.4 and <= 0.3.13Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.