EUVD-2026-97301
GHSA-gfx7-4mpr-25fj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach agent exposing run_shell
-
ExploitSubmit allowlisted interpreter command
-
ExecutionBypass base_dir allowlist filter
-
ImpactExecute arbitrary OS commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires CodingTools to be instantiated with the run_shell tool enabled - enable_run_shell was True by DEFAULT in versions up to 3.0.9 (changed to False in 3.0.10) - AND an operator relying on restrict_to_base_dir as a security boundary. The attacker must be able to control the 'command' argument reaching run_shell, i.e. untrusted input must flow into the agent's tool call. The bypass works specifically because allowlisted interpreters (python, pip, git) can execute arbitrary inline code (e.g. python -c), defeating the allowlist and metacharacter block. Limiting factors: the tool must be explicitly wired into an exposed agent, exploitation assumes PR:L (some access to invoke the agent's tooling) and UI:P (the deployment model expects human supervision), and environments that never enabled run_shell or that run it in a true sandbox are not exposed. |
| Impact | Real-world priority is LOW, and the signals are internally consistent on that point. The vendor/VulDB CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P with only Low impacts) yields a base score of 2.0, and the E:P threat metric reflects a proof-of-concept rather than mature/active exploitation. A public exploit/advisory exists (publicly available exploit code exists), but there is no CISA KEV listing and no EPSS score was provided, so exploitation probability cannot be quantified from the input. The nominal CWE-78 'OS command injection' label overstates the issue: run_shell is an opt-in tool explicitly DESIGNED to execute shell commands, and the actual defect (per the linked advisory and patch) is that the restrict_to_base_dir allowlist/metacharacter filter is not a real sandbox - allowlisted interpreters like python can still run arbitrary inline code. This is better understood as a security-hardening fix (and a documentation/default-hardening change making enable_run_shell default to False) than a classic remotely triggerable RCE. Tension to note: CWE-78 and 'attack may be initiated remotely' sound severe, but PR:L + UI:P + Low impacts and the opt-in nature contradict a high-urgency reading. EPSS is MISSING and the only reporter is VulDB, which commonly auto-files low-severity open-source issues - treat the 'remote' framing cautiously. |
| Exploit ScenarioDerived | An attacker able to influence the input of an Agno agent that has CodingTools.run_shell enabled (the default in <=3.0.9) and relies on restrict_to_base_dir as a boundary submits a command invoking an allowlisted interpreter (e.g. 'python -c ...'). The inline code bypasses the metacharacter block and path restriction, letting the caller read arbitrary files, dump the process environment, or reach the network. A public advisory/PoC documents this disallowlist bypass; the CVSS vector (AV:N/AC:L, but PR:L and UI:P) means it needs some access to the agent and a supervising human in the loop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
OS command injection in the Agno agent framework's CodingTools.run_shell helper (versions up to and including 3.0.9) lets an authenticated caller who can influence the tool's command argument execute arbitrary shell commands on the host running the agent. The weakness is a bypass of the restrict_to_base_dir allowlist and metacharacter block rather than an absence of one: allowlisted interpreters such as python, pip and git can be invoked with inline-code options (for example python -c) to run arbitrary code, so the restriction only reduces accidental damage and is explicitly documented as 'not a security sandbox'. Publicly available exploit code exists, but the practical risk is LOW: exploitation requires run_shell to be enabled (it was on by default through 3.0.9 and is off by default from 3.0.10), an agent wired to accept untrusted input, and the affected CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L, with the vendor-supplied CVSS 4.0 score of 2.0 consistent with that low assessment. There is no indication of confirmed active exploitation (not in CISA KEV), and a vendor patch is available - upgrade to 3.0.10.
RemediationAI
Upgrade to Agno 3.0.10 or later, which flips the enable_run_shell default to False and hardens the allowlist against interpreter-based bypasses - the vendor-released fix is the tagged release v3.0.10 (https://github.com/agno-agi/agno/releases/tag/v3.0.10), corresponding to patch commit ed64fab5be63d2b15faddc2ef7c733176daa14aa and pull request https://github.com/agno-agi/agno/pull/10210. If immediate upgrade is not possible, the highest-value compensating control is to construct CodingTools with enable_run_shell=False (or upgrade only the toolkit and pass the flag explicitly) so the shell primitive is never exposed; the trade-off is that agents lose shell execution entirely and must fall back to the read/edit/write and grep/find/ls tools. Do not treat restrict_to_base_dir as a security boundary - the project documentation now states an allowlisted interpreter (python, pip, git) can read arbitrary files, dump environment variables or reach the network even with the restriction enabled. Where run_shell is genuinely required, execute the agent in a real sandbox: a separate process or container with a scrubbed environment, no network egress and read-only mounts, which costs performance and operational complexity but is the only mitigation that reliably contains arbitrary command execution. Additionally, ensure untrusted or third-party content can never flow into the tool's command argument, keep human supervision in the loop as the deployment model assumes, and review logs of agent tool invocations for unexpected shell usage; the public exploit write-up at https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-codingtools-run-shell-disallowlist-bypass-command-execution.md can be used to build detection test cases.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Agno is a Python framework for building tool-using LLM agents, and its CodingTools toolkit (libs/agno/agno/tools/coding.py) exposes file and shell primitives - read, edit, write and the optional run_shell - that let an agent perform coding tasks. run_shell passes the model-supplied command argument to the system shell, which is the classic CWE-78 OS command injection sink: any untrusted input that reaches the tool call (for example prompt-injected content or third-party data the agent reads) is interpreted as shell syntax. Through version 3.0.9 the enable_run_shell constructor flag defaulted to True, so merely instantiating CodingTools exposed the shell primitive. The 3.0.10 fix (PR #10210, commit ed64fab5be63d2b15faddc2ef7c733176daa14aa) flips that default to False and hardens the restrict_to_base_dir guard by adding a code-execution interpreter prefix blocklist and detection of CPython inline-execution short options such as -c and -m. Importantly, the maintainers' own updated docstrings state that the allowlist plus metacharacter block 'is NOT a security sandbox' and that any allowlisted interpreter can read arbitrary files, dump the process environment or reach the network, so the root cause is an inherently unsandboxable design rather than a single missed character filter. Dependent CPE cpe:2.3:a:agno-agi:agno:*:*:*:*:*:*:*:* matches the whole release line prior to the fix.
Know when Agno gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable agent but PR:L and UI:R because the opt-in run_shell tool must be enabled and operator-supervised; impacts kept Low as it is a restriction bypass of an intentional shell executor, S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Model-influenced tool calls in the Agno agent framework (agno-agi) through 3.0.6 and 3.1.1 reach Python exec()/runpy()/s
Missing authentication in Agno (agno-agi) through version 2.7.3 and 3.0.6 causes AgentOS agent endpoints to be reachable
Remote code execution in Agno prior to version 2.3.24 allows attackers to execute arbitrary Python code by manipulating
SQL injection in agno 2.6.5's ClickHouse vector database backend allows authenticated attackers to inject arbitrary SQL
Agno's Team Delegation Feature runs member agents without a confirmation gate, allowing an actor who can influence deleg
Code injection in the PythonTools component of Agno (agno-agi/agno) through version 3.0.6 lets an attacker who can influ
Exploit-DB