Agno PythonTools CVE-2026-76832

Exploitation requires an agno agent deployment with PythonTools instantiated and reachable by the attacker either via direct API/tool invocation or via content the agent processes (prompt injection vector). The pre-patch PythonTools constructor offered no restrict_to_base_dir flag, so all pre-fix deployments using any of read_file, save_to_file, or run_python_file are vulnerable regardless of configuration. Exploitation is limited by: (1) OS-level sandboxing - if the agent process runs in a container or chroot restricted to a single directory, traversal still occurs but reachable files are bounded by that environment; (2) agent-level guardrails or system prompts that prevent tool calls based on untrusted content, though no such mitigation was present by default in the vulnerable version; (3) process user permissions - the attacker can only reach files readable/writable/executable by the agent process user. The CVSS 4.0 UI:A metric reflects that a user or agent pipeline action must trigger tool invocation; passive exploitation without any agent activity is not possible.

The CVSS 4.0 score of 8.5 with AV:A and UI:A indicates network-adjacent delivery requiring active interaction, which understates real-world risk in agentic deployments: prompt injection via externally sourced content (web pages, documents, API responses) that the agent processes constitutes a network-delivered attack requiring only that the agent pipeline be exposed to untrusted input, pushing the practical attack vector closer to AV:N. EPSS data is absent from the provided intelligence, preventing probabilistic exploitation rate comparison. KEV status is negative and no public POC is confirmed, which moderates immediate urgency, but the exploitation primitives - arbitrary file read, write, and Python execution bounded only by the process user's OS permissions - are high-value and the technique is well understood. The SSVC automation dimension is unfavorable: because the exploit can ride prompt injection in any content the agent processes, attacks can be automated against any deployment where the agent ingests untrusted text. Even a small team operating an agno-based service with PythonTools enabled and exposed to external content should treat remediation as urgent. The scope change (breaking out of base_dir to the broader host filesystem) means the vulnerable-system and subsequent-system impact boundary requires careful assessment per deployment.

An attacker embeds a prompt injection payload in a webpage or document processed by an agno agent - for example, invisible text instructing the agent to call read_file with file_name='../../../../../../etc/shadow' and relay the output. The agent, lacking independent validation of tool arguments, invokes PythonTools.read_file() with the traversal sequence, bypasses the base_dir boundary, and returns the contents of the sensitive file to the attacker-controlled conversation. With write and execute primitives also exposed via save_to_file and run_python_file, a chained payload can drop and execute an arbitrary Python script, yielding a reverse shell running as the agent process user.