AWS disclosed command injection in versions 1.0.0 through 1.7.0 of its databases-on-aws Agent Plugin and identifies 1.7.1 as corrected. The vendor bulletin concerns a local helper invoked by an agent, with effects limited by the helper process's permissions. Attacker-influenced material must reach the agent and become arguments to the vulnerable helper…
Inspect the ClaimsCase · DiggingBeagle record
AWS databases-on-aws agent plugin permitted argument-driven shell execution
AWS disclosed CVE-2026-107322, command injection in databases-on-aws Agent Plugins affecting 1.0.0 to 1.7.0 under attacker-influenced helper arguments.
Scope
Local Agent Plugin command injection CVE-2026-107322, with fix 1.7.1 documented by AWS in October 2026.
Assessment profile
Assessment method- Exploitation
- not established
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
AWS confirms an affected local helper and an available patch; this bulletin does not establish operational exploitation. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-AWS-PLUGIN-INJECT-1 · CLM-R4-AWS-PLUGIN-INJECT-2 · CLM-R4-AWS-PLUGIN-INJECT-3 · AWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injection
At a glance
Agent tool implementations need safe argument handling even when model-facing instructions label a tool as approved.
Read the implicationsNo confirmed exploitation or affected customer population in the source. Exposure depends on where the helper executes and which agent or user can control its arguments.
Limits and uncertaintyFull account
AWS disclosed command injection in versions 1.0.0 through 1.7.0 of its databases-on-aws Agent Plugin and identifies 1.7.1 as corrected. The vendor bulletin concerns a local helper invoked by an agent, with effects limited by the helper process's permissions.
Attacker-influenced material must reach the agent and become arguments to the vulnerable helper before command execution is possible. The bulletin does not establish exploitation in a customer environment. Aurora DSQL itself is not the affected component.
AWS dates marketplace availability of the correction to August 26, preceding its October 8 disclosure. A pinned checkout needs the corrected commit identified by the vendor. The release and timing distinction matters because publication of the bulletin was not the first availability of the repair.
Mechanism and trust boundary
- 01
Conditional local execution
Untrusted content must reach an agent which then invokes the vulnerable helper. Commands inherit that process's permissions; Aurora DSQL itself is unaffected.
Boundary: Agent-ingested content becomes local shell input.
Timeline
- Oct 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-AWS-PLUGIN-INJECT-1AWS disclosed CVE-2026-107322, command injection in databases-on-aws Agent Plugins affecting 1.0.0 to 1.7.0 under attacker-influenced helper arguments.supported
Basis: reported finding
- supportsAWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injectionprimary disclosure
AWS security bulletin, Impact and Affected versions.
CLM-R4-AWS-PLUGIN-INJECT-2AWS states that 1.7.1 contains the fix; the vulnerable code is a local agent helper, not a remotely listening Aurora database endpoint.supported
Basis: reported finding
- supportsAWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injectionprimary disclosure
AWS security bulletin, Resolution and affected component.
CLM-R4-AWS-PLUGIN-INJECT-3AWS dates marketplace availability of the correction to August 26, 2026, preceding its October 8 bulletin. Pinned checkouts need the corrected commit rather than an assumed release tag.supported
Basis: reported finding
- supportsAWS security bulletin 2026-130: CVE-2026-107322 agent plugin command injectionprimary disclosure
Resolution, paragraphs 1-2; Publication Date.
Implications
Agent tool implementations need safe argument handling even when model-facing instructions label a tool as approved.
Controls and mitigations
- AWS recommends updating and verifying the active plugin. Avoiding the optional psql helper path is a temporary workaround; reduced host and database privileges limit consequences.
Unknowns and contradictions
- No confirmed exploitation or affected customer population in the source.
- Exposure depends on where the helper executes and which agent or user can control its arguments.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 141