Command Injection in AWS Bedrock AgentCore Python SDK install_packages()

CVE-2026-12530 is a command injection vulnerability in the AWS Bedrock AgentCore Python SDK affecting versions >= 1.1.3 and < 1.6.1. The flaw is in the install_packages() method used by the Code Interpreter client, where package name arguments were sanitized with an incomplete blocklist before being incorporated into a shell command equivalent to 'pip install'. Because argument delimiters and pip options were not properly neutralized, a remote authenticated user could supply crafted package name arguments that bypass validation. Reported abuse paths include injecting pip flags such as '--index-url' to redirect package resolution to an attacker-controlled package repository and '-r' to cause pip to read files from within the sandbox. The result is arbitrary command execution within the Code Interpreter sandbox and unintended access to sandbox-resident data.