Agno EUVD-2026-97299

Exploitation requires the attacker to control the 'code' argument passed to the run_python_code function of the PythonTools component - i.e. the Agno agent must be deployed with PythonTools enabled and reachable, and the attacker must be able to influence the code string it executes. CVSS PR:L indicates a low-privilege authenticated foothold is needed, so this is not an unauthenticated drive-by: realistic paths are an authorized-but-malicious user of the agent, or indirect prompt injection that steers the LLM into invoking the tool with attacker-chosen code. LIMITING FACTORS: PythonTools must be configured/active (it is an optional agent tool, not a default endpoint), the attacker needs at least low-level access per PR:L, and the vendor's LOW impact rating suggests execution may occur in a constrained context - verify whether a sandbox bounds the resulting access.

Signals point to a LOW real-world priority despite the alarming CWE-94 'code injection' / RCE framing. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with uniformly LOW impacts (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) yields only 2.1, and E:P marks exploitation as proof-of-concept rather than active. A public exploit advisory exists (GitHub), so 'publicly available exploit code exists' - but there is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread or automated exploitation cannot be asserted. The core tension: the affected function run_python_code in PythonTools is, by design, a code-execution primitive - an Agno agent tool whose purpose is to run Python. 'Code injection' here is close to intended behavior, which likely explains why the vendor rated impact LOW rather than the High you would expect from true arbitrary RCE. This also explains why the project 'has not responded' to the issue report. CONFLICT TO VERIFY: a function that executes attacker-controlled Python should, on a naive reading, produce High confidentiality/integrity/availability impact, yet the vector claims only Low - verify with the vendor whether a sandbox or restricted execution context limits the blast radius, because if not, real impact is materially higher than the 2.1 score implies. PR:L means an attacker needs some authenticated/privileged foothold (or, in agent deployments, the ability to steer the LLM into calling the tool via prompt injection), which further narrows realistic exploitation to already-authorized or already-compromised agent contexts rather than opportunistic internet-wide attack.

An attacker with low-privilege access to an Agno-based agent application (or who can influence agent input to trigger tool use) supplies a malicious payload to the PythonTools run_python_code function, causing attacker-chosen Python to execute within the application process. A public proof-of-concept advisory demonstrating this is available on GitHub, and because the attack vector is network-based with low complexity, it can be reproduced remotely once the attacker holds the required low-level access.