Agent Development Kit Adk For Python
Monthly
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Cross-application artifact access in Google Agent Development Kit (ADK) for Python lets a caller in one ADK application list, read, overwrite or delete file-backed artifacts belonging to a different application when both applications share the same FileArtifactService root directory and operate under the same user_id (plus the same session_id for session-scoped artifacts). This is an authenticated, low-privilege issue (CVSS 4.0 5.3, vector PR:L) and only manifests in that specific shared-root, colliding-identity deployment; single-application deployments, apps with distinct roots, and apps with distinct user_ids are not affected, so it is a bounded tenant-isolation flaw rather than an emergency. Affected ranges are 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0, with 2.6.0 being only partially fixed; there is no CISA KEV listing and no confirmed working exploit, only a public issue/PR reference (google/adk-python#5618 and #5619), and vendor patches are released in 1.39.1 and 2.7.0.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Cross-application artifact access in Google Agent Development Kit (ADK) for Python lets a caller in one ADK application list, read, overwrite or delete file-backed artifacts belonging to a different application when both applications share the same FileArtifactService root directory and operate under the same user_id (plus the same session_id for session-scoped artifacts). This is an authenticated, low-privilege issue (CVSS 4.0 5.3, vector PR:L) and only manifests in that specific shared-root, colliding-identity deployment; single-application deployments, apps with distinct roots, and apps with distinct user_ids are not affected, so it is a bounded tenant-isolation flaw rather than an emergency. Affected ranges are 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0, with 2.6.0 being only partially fixed; there is no CISA KEV listing and no confirmed working exploit, only a public issue/PR reference (google/adk-python#5618 and #5619), and vendor patches are released in 1.39.1 and 2.7.0.