Agno EUVD-2026-97318

Requires (1) the agent to be built with agno's PythonTools toolkit exposing the code-executing tools (run_python_code, save_to_file_and_run, run_python_file_return_variable, pip_install_package, uv_pip_install_package) without an explicit requires_confirmation_tools gate - which was the vulnerable default in versions up to 3.0.6/3.1.1 - and (2) the attacker to be able to influence the model's input (prompt injection via untrusted data the agent ingests). LIMITING FACTORS: agents that do not load PythonTools code-execution tools, that run them inside a real sandbox, or that already set requires_confirmation_tools are not exploitable; deployments that never feed attacker-controlled content to the model sharply reduce realistic risk. No end-user click is needed (the agent calls the tool autonomously), but the operator-chosen toolkit configuration is the key prerequisite.

This is a moderate-but-conditional risk whose raw CVSS 4.0 base score of 6.9 (E:P) understates the technical impact while the deployment precondition understates it in the other direction. The VulDB vector (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L) rates confidentiality/integrity/availability as only 'Low', but the source-code evidence shows the actual defect is a missing human-confirmation gate on PythonTools' code-executing functions (run_python_code, save_to_file_and_run, run_python_file_return_variable, pip_install_package, uv_pip_install_package), so a model-influenced tool call reaches exec()/runpy()/subprocess with NO pause - i.e. arbitrary code execution in the host process, which I assess as High impact, not Low. The '4.0/E:P' exploit-maturity flag plus the published advisory and POC confirm public exploit code exists, but there is NO CISA KEV listing and no EPSS value supplied, so there is no evidence of widespread active exploitation - treat as proof-of-concept, not in-the-wild. The decisive limiter is deployment: exploitation only matters where an operator has enabled the PythonTools code-execution tools AND exposes the agent to attacker-influenced input (prompt injection). CONFLICT TO VERIFY: VulDB impact metrics (VC/VI/VA:L) contradict the code evidence of full code execution - the 'Low' impacts and the 'Information Disclosure' tag appear to under-rate an RCE-class flaw. Priority is elevated for anyone running agno's PythonTools against untrusted content and low for everyone else.

An agno-based agent is configured with the default PythonTools toolkit and processes untrusted content (a web page, email, document, or user message). An attacker embeds a prompt-injection payload that causes the model to emit a run_python_code tool call; because the code-executing tools were not gated by confirmation in versions up to 3.0.6/3.1.1, the orchestration loop runs the attacker's Python immediately via exec()/subprocess. Public exploit code and a detailed advisory exist, and the referenced test (test_default_assembly_pauses_model_requested_code_execution) demonstrates a marker-file write proving execution.