Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip Flags

> NOTE! Thanks for submitting a report to Amazon Web Services! Please replace *all* the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report!

# Sanitize package names (basic validation)
for pkg in packages:
    if any(char in pkg for char in [";", "&", "|", "`", "$"]):
        raise ValueError(f"Invalid characters in package name: {pkg}")

packages_str = " ".join(packages)
upgrade_flag = "--upgrade " if upgrade else ""
command = f"pip …