CVE-2026-37003 in Agno
Summary
by MITRE • 08/27/2026
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
Agno versions up to and including 2.5.8 contain a critical Remote Code Execution vulnerability stemming from improper neutralization of user input within its PythonTools and ShellTools components. This flaw allows an unauthenticated attacker to execute arbitrary code or operating system commands on the host server by leveraging prompt injection techniques. The core technical issue lies in how these tools handle arguments generated by Large Language Models. Instead of validating, sanitizing, or restricting the output from the LLM before passing it to execution sinks such as exec(), runpy.run_path(), and subprocess.run(), Agno passes these unsanitized values directly into the interpreter or shell environment. This design choice creates a direct pathway for malicious payloads embedded in user-provided content to be executed with the privileges of the running application process, effectively bypassing any intended security boundaries within the agent framework.
The operational impact of this vulnerability is severe, as it grants full control over the underlying system where Agno is deployed. An attacker can exploit this by embedding malicious instructions or code snippets into documents, web pages, or other data sources that are processed by the AI agent. When the LLM processes this content and generates arguments for tool execution based on its interpretation of the prompt, it may inadvertently include commands crafted to perform destructive actions such as reading sensitive files, exfiltrating data, installing backdoors, or pivoting to other systems within the network. Because the vulnerability affects unauthenticated access points, any user interacting with the system through supported interfaces can trigger this chain of events without needing valid credentials, significantly expanding the attack surface and increasing the risk of widespread compromise in production environments utilizing Agno for automated task execution.
From a classification perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-78 OS Command Injection, as it involves the injection of malicious code or commands into an interpreter via unsanitized input. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically involving subcategories like Python (T1059.007) for arbitrary code execution using the exec function, as well as T1620 Reflective Code Injection if the payload is loaded into memory without writing to disk. The vulnerability also reflects weaknesses in input validation principles outlined in CWE-20 Improper Input Validation and highlights risks associated with trusting unverified outputs from generative models, which falls under broader concerns regarding AI supply chain security and prompt injection attacks documented in OWASP Top 10 for LLM applications.
To mitigate this risk, immediate action is required to upgrade Agno to a version that addresses these execution sink vulnerabilities or implement robust input validation layers if upgrading is not immediately feasible. Developers should ensure that all arguments passed to exec(), runpy.run_path(), and subprocess.run() are strictly validated against an allowlist of expected commands or parameters rather than relying on the LLM's output integrity. It is critical to avoid passing raw LLM-generated strings directly into system interpreters; instead, use parameterized calls where possible and restrict shell access by disabling shell=True in subprocess calls unless absolutely necessary and properly sanitized. Additionally, running Agno instances with minimal privileges using principle of least privilege can limit the damage caused if an exploit succeeds. Regular security audits focusing on how external data influences internal tool execution flows are essential to prevent similar injection vectors from being introduced through future updates or custom integrations within the agent architecture.