CVE-2026-76832 in Agno
Summary
by MITRE • 08/20/2026
Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool actions. Attackers can inject traversal sequences such as '../../../../../../etc/passwd' through direct tool invocation or via prompt injection embedded in agent-processed content to escape the intended base_dir boundary and achieve arbitrary file read, arbitrary file write, or arbitrary Python code execution within the process user's authority.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Agno's PythonTools module represents a critical path traversal flaw that undermines the security boundaries of automated agent systems. This issue resides specifically within the libs/agno/agno/tools/python.py implementation and affects three primary tool actions: read_file, save_to_file, and run_python_file. The core technical failure stems from insufficient validation or sanitization of the file_name argument provided by users or injected via prompt manipulation. When an attacker supplies parent-directory traversal sequences such as ../../../../../../etc/passwd, the application fails to properly resolve these paths against a designated base directory. Instead, it allows the operating system's path resolution mechanisms to traverse upward through the filesystem hierarchy, effectively bypassing the intended sandbox or working directory constraints. This lack of strict input validation enables an adversary to escape the restricted environment and access files located outside the authorized scope, leading to severe confidentiality, integrity, and availability compromises depending on the specific action exploited.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The flaw arises because the application does not canonicalize or strictly validate the input path before processing it with file system operations. In many modern frameworks, secure coding practices require resolving the absolute path and verifying that it remains within the allowed base directory prefix after normalization. Agno's PythonTools fails to implement this check adequately, allowing relative paths containing dot-dot sequences to resolve to arbitrary locations on the host filesystem. This is particularly dangerous in agent-based architectures where tools are invoked dynamically based on natural language prompts or internal reasoning steps. If an attacker can influence the input data processed by the agent, they can embed traversal payloads that the tool executes without raising errors, as the underlying Python file operations accept these paths as valid relative references to locations outside the sandbox.
The operational impact of this vulnerability is severe and multifaceted. For read_file actions, attackers can exfiltrate sensitive configuration files, source code containing hardcoded credentials, or private user data stored in accessible directories. This leads directly to a breach of confidentiality and potential compliance violations depending on the nature of the exposed data. In the case of save_to_file, an attacker could overwrite critical system files, application configurations, or other users' data within the process's write permissions, leading to integrity loss and potentially causing denial of service through file corruption. Most critically, the run_python_file action allows for arbitrary code execution. By writing a malicious Python script to a writable directory and then executing it via this tool, an attacker can achieve remote code execution (RCE) with the privileges of the user running the Agno agent process. This could lead to full system compromise, lateral movement within a network, or persistence mechanisms being established on the host machine.
This vulnerability is frequently exploitable through prompt injection attacks in large language model integrations. Since agents often process untrusted content from web pages, emails, or other external sources, an attacker can embed traversal sequences within that content. When the agent processes this content and decides to use a file-related tool based on its internal reasoning, it may inadvertently pass the malicious path to the vulnerable function. This aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically when used for arbitrary code execution via script files. It also relates to T1083: File and Directory Discovery, as attackers use traversal sequences to map out the filesystem structure before launching more destructive payloads. The combination of these techniques allows an adversary to transition from simple information gathering to full system control if proper mitigations are not in place.
To mitigate this vulnerability, immediate remediation efforts should focus on strict input validation and path canonicalization within the PythonTools module. Developers must ensure that all file paths provided to read_file, save_to_file, and run_python_file are resolved to their absolute forms using secure functions such as os.path.realpath or pathlib.Path.resolve before any filesystem operation is performed. The application must then verify that this resolved absolute path starts with the intended base directory prefix. If it does not, the request should be rejected immediately with an appropriate error message. Additionally, implementing a whitelist of allowed directories and restricting file extensions for execution can provide defense-in-depth measures. For run_python_file specifically, consider sandboxing the execution environment using containers or restricted user accounts to limit the blast radius even if traversal is attempted. Regular security audits and static analysis tools configured to detect CWE-22 patterns should be integrated into the development pipeline to prevent similar issues in future updates.