HackerOne Disclosed Reports - 2026-11-06

Medium
resolved

Unescaped consent-prompt renderer (HTML()) enables concealed-approval OS command injection in strands-agents/tools use_computer — RCE

Bug reported by peeker was disclosed at November 6, 2026, 2:33 pm   |   OS Command Injection

A vulnerability was discovered in an agent tool framework where user consent prompts were rendered without proper escaping. Markup embedded in tool arguments was interpreted rather than displayed, allowing attackers to conceal malicious commands within prompts that appeared benign to operators. When combined with unsanitized command execution sinks in the application focus feature, this enabled arbitrary operating system command execution on the agent host after operator approval. The vulnerability affected multiple tools and consent surfaces through the same unescaped rendering mechanism. The issue was confirmed through proof-of-concept demonstrations showing command execution and concealment techniques using the prompt rendering parser.