AWS Bedrock AgentCore Python SDK – Critical Package Installation Vulnerability

AWS Bedrock AgentCore Python SDK (bedrock-agentcore) versions 1.1.3 through 1.6.0 have a nasty security flaw in the install_packages() method. The vulnerability lets attackers bypass argument validation and inject dangerous pip flags like --index-url (redirecting to malicious PyPI servers) or -r (reading arbitrary sandbox files). If you're using affected versions, update to 1.6.1 or later immediately—this one requires action.