| शीर्षक | Agno AGI Agno 2.7.3 CWE-78 OS Command Injection |
|---|
| विवरण | agno's CodingTools.run_shell executes every command string with subprocess.run(command, shell=True) after screening it against an incomplete disallowlist of shell operators. The default restricted mode (restrict_to_base_dir=True) can be bypassed by chr()-encoding the payload, so that a command such as python -c "exec(chr(...)+chr(...))" contains none of the disallowed substrings yet still executes arbitrary Python -- and therefore arbitrary OS commands -- on the host with the privileges of the agno process. Anyone able to influence the command argument, by calling the toolkit directly or by driving the tool remotely through prompt injection against a network-exposed agent, achieves arbitrary code execution.
Affected: agno <= 3.0.6. Patched versions: None.
Reported to the vendor: https://github.com/agno-agi/agno/issues/10048. |
|---|
| स्रोत | ⚠️ https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-codingtools-run-shell-disallowlist-bypass-command-execution.md |
|---|
| उपयोगकर्ता | Ybyu (UID 101038) |
|---|
| सबमिशन | 08/09/2026 10:11 AM (2 महीनों पहले) |
|---|
| संयम | 11/10/2026 12:41 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416594 [agno-agi agno तक 3.0.9 CodingTools coding.py agno.CodingTools.run_shell command अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|