EUVD-2026-67272
GHSA-g3w9-2xgv-r24v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Agno agent ingesting external content
-
DeliveryPlant malicious instructions in web page/document
-
ExploitAgent processes content and emits tool call
-
ExecutionPythonTools/ShellTools passes args to exec/subprocess
-
ImpactArbitrary OS command execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Agno deployment has the PythonTools and/or ShellTools components enabled and that the agent processes attacker-influenceable content (e.g., a web page or document the attacker can plant instructions in). Given those, per the CVSS vector no authentication or user interaction is needed and the vector is network-reachable. The key LIMITING factors are configuration-dependent: if the code-execution tools are not enabled, or the agent never ingests untrusted content, the vulnerability is not reachable - so this is not exploitable against a default agent that lacks these tools, despite the 9.8/PR:N rating. |
| Impact | The signals conflict and should be weighed carefully. CVSS 3.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) treats this as trivial remote unauthenticated full compromise, but that rating assumes the worst-case deployment. Real-world exploitability is gated by two conditions the CVSS score does not capture: the application must have enabled the code-execution tools (PythonTools/ShellTools), and it must route attacker-influenced content through the agent. EPSS is low (0.60%, 46th percentile) and there is no KEV listing and no public exploit identified, which is consistent with a serious-but-not-yet-widely-weaponized issue rather than mass exploitation. SSVC framing: technical impact is total, but 'automatable' is questionable because success depends on non-default, high-risk tool configuration. Net: genuinely critical for any deployment that exposes PythonTools/ShellTools to untrusted content, and largely inapplicable to deployments that do not enable those tools - so prioritize based on your own configuration rather than the raw 9.8. |
| Exploit ScenarioDerived | An organization runs an Agno agent with PythonTools/ShellTools enabled to summarize web pages on demand. An attacker publishes a page containing hidden instructions that coerce the model into calling ShellTools with an attacker-chosen command; when the agent fetches and processes the page, the command executes on the host server. No public exploit code is identified, but the technique (indirect prompt injection into a code-execution tool) is well understood and the attack is network-reachable and unauthenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Remote code execution in Agno (the Python AI-agent framework) up to and including 2.5.8 lets attackers run arbitrary code and OS commands on the host by way of prompt injection. The PythonTools and ShellTools components feed LLM-generated arguments straight into exec(), runpy.run_path(), and subprocess.run() without sanitization, so an attacker who plants malicious instructions in any content the agent ingests (a web page, a document) can hijack execution. CVSS is rated 9.8 and the CVSS vector marks it unauthenticated/network, but no public exploit is identified at time of analysis and EPSS is low at 0.60% (46th percentile).
RemediationAI
No vendor-released patched version is identified at time of analysis, so upgrade to a fixed Agno release as soon as one is published beyond 2.5.8 and monitor http://agno.com and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-37003) for the fixed version. As compensating controls until then: disable the PythonTools and ShellTools tools in agent configurations that process any untrusted input (this removes the code-execution sink but obviously removes those capabilities from the agent); if the tools are required, run the agent in a strongly sandboxed, network-restricted, least-privilege container or microVM so that code execution cannot reach production data or lateral targets (trade-off: added operational complexity and latency); and restrict which content sources the agent is allowed to ingest, avoiding fetching arbitrary web pages or user-supplied documents through code-capable agents (trade-off: reduced automation scope). Do not rely on prompt-level guardrails alone, since the root cause is unsanitized arguments reaching execution sinks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Agno is an open-source Python framework for building LLM agents (previously known as Phidata) that ships optional 'tools' an agent can call during reasoning. Two of those tools - PythonTools and ShellTools - are designed to execute code and shell commands, and the flaw is that the arguments to those tools come from untrusted LLM output that is itself steerable by attacker-supplied content. This is a textbook CWE-94 (Improper Control of Generation of Code / code injection): the dangerous sinks exec(), runpy.run_path(), and subprocess.run() receive unsanitized strings, so anything that influences the model's tool-call arguments influences what code runs. The CPE string cpe:2.3:a:n/a:n/a is a placeholder and does not identify the real product; the affected component is the Agno library itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated with total impact, but AC:H because it depends on the non-default configuration of enabling code-execution tools and routing untrusted content through the agent.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
Executive ViewAI
Agno (Python AI-agent framework) through version 2.5.8 contains a critical remote code execution vulnerability that can be triggered when the platform processes any untrusted content, including web pages, documents, or user inputs. Organizations relying on Agno for automation face risk of complete system compromise if an attacker injects malicious instructions into content the agent processes. No vendor patch is available at present, and the vulnerability is config-dependent but carries broad risk for organizations with PythonTools or ShellTools enabled.
Disable PythonTools and ShellTools on all deployments unless absolutely required for business operations; implement input validation and content-source restrictions (trusted data only); deploy network segmentation to isolate affected systems from sensitive infrastructure; enable runtime monitoring for unexpected subprocess execution and file system changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB