tools

v0.8.3 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 17d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

agentic agentic-ai agents ai anthropic autonomous-agents

+13 more

bedrock genai litellm llama llm machine-learning mcp multi-agent-systems ollama openai opentelemetry python strands-agents

Affected surfaces

rce_ssrf auth

Summary

AI summary

Updates 🐛 Fixes, 👷 CI, and python_repl across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Bugfix
Bugfix	Medium	Block sympify string-eval escape without breaking safe constructors. Block sympify string-eval escape without breaking safe constructors. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Bind tenant namespace out of LLM-controllable tool inputs. Bind tenant namespace out of LLM-controllable tool inputs. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Add STRANDS_DISABLE_LOAD_TOOL to PROTECTED_VARS. Add STRANDS_DISABLE_LOAD_TOOL to PROTECTED_VARS. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Restrict permissions on persisted state and error logs in Python REPL. Restrict permissions on persisted state and error logs in Python REPL. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Create global REPL state lazily. Create global REPL state lazily. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Prompt for confirmation before loading a tool file. Prompt for confirmation before loading a tool file. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

v0.8.3

Auto-drafted from commits in v0.8.2..v0.8.3, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🐛 Fixes

fix(calculator): block sympify string-eval escape without breaking safe constructors (#525) (dda776c)
fix(memory): bind tenant namespace out of LLM-controllable tool inputs (#532) (5a44777)
fix(environment): add STRANDS_DISABLE_LOAD_TOOL to PROTECTED_VARS (#531) (ad2bb0a)
fix(python_repl): restrict permissions on persisted state and error logs (#517) (fde46a0)
fix(python_repl): create global REPL state lazily (#516) (0644ca9)
fix(load_tool): prompt for confirmation before loading a tool file (#515) (784cef4)

📚 Documentation

docs(bright_data): use a neutral example domain in usage docs (#523) (a040165)

👷 CI

ci: add aggregate CI Gate status check (#536) (0504303)
ci: added full release workflow (#533) (39d3b47)

Security Fixes

fix(calculator): block sympify string-eval escape without breaking safe constructors
fix(memory): bind tenant namespace out of LLM-controllable tool inputs
fix(python_repl): restrict permissions on persisted state and error logs
fix(environment): add STRANDS_DISABLE_LOAD_TOOL to PROTECTED_VARS

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track tools

Get notified when new releases ship.

About tools

A set of tools that gives agents powerful capabilities.

All releases →