EUVD-2026-67272
GHSA-g3w9-2xgv-r24v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated with total impact, but AC:H because it depends on the non-default configuration of enabling code-execution tools and routing untrusted content through the agent.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
AnalysisAI
Remote code execution in Agno (the Python AI-agent framework) up to and including 2.5.8 lets attackers run arbitrary code and OS commands on the host by way of prompt injection. The PythonTools and ShellTools components feed LLM-generated arguments straight into exec(), runpy.run_path(), and subprocess.run() without sanitization, so an attacker who plants malicious instructions in any content the agent ingests (a web page, a document) can hijack execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Agno deployment has the PythonTools and/or ShellTools components enabled and that the agent processes attacker-influenceable content (e.g., a web page or document the attacker can plant instructions in). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified at time of analysis, so upgrade to a fixed Agno release as soon as one is published beyond 2.5.8 and monitor http://agno.com and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-37003) for the fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a full inventory of Agno deployments and identify which instances have PythonTools or ShellTools enabled and what content sources they process. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today