Description

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T09:16:43.037Z",
  "pubdate": "2026-10-12T09:16:43.037Z",
  "executiveSummary": "A critical code injection vulnerability exists in the PythonTools component of agno-agi agno, specifically within the run_python_code function, affecting versions up to 3.0.6.\nThe vulnerability arises from insufficient sanitization of user-supplied input provided to the code execution engine, allowing an attacker to execute arbitrary Python code within the host environment.\nThis flaw is remotely exploitable and represents a significant security risk, as it allows for full system compromise, unauthorized data access, and potential lateral movement within the infrastructure.\nPublicly available exploit code increases the urgency of remediation, as the attack surface is exposed to potential threat actors.\nBecause the project maintainers have not yet responded to disclosure, users are currently without an official patch, necessitating immediate independent defensive measures.",
  "technicalDetails": "The vulnerability is located in the run_python_code function within the python.py file of the PythonTools component. The root cause is the improper handling and lack of sandboxing for the 'code' argument passed to the execution function.\nThe component facilitates the dynamic execution of Python code provided as a string parameter. Without adequate validation, filtering, or the use of restricted execution environments (such as dedicated containers or sandboxed interpreters), the underlying system evaluates the provided input as native Python instructions.\nAn attacker can exploit this by crafting a malicious payload within the 'code' argument. When the application processes this request, the interpreter executes the attacker's code with the same privileges as the agno process. This bypasses typical input validation controls, as the vulnerability resides in the core execution logic rather than application-level input sanitization.\nThe attack flow follows a direct vector: the attacker submits a request to the application containing the injection payload targeting the run_python_code interface. Upon receipt, the application passes the unsanitized string directly to the Python interpreter. The execution occurs immediately, allowing the attacker to perform arbitrary actions such as reading system files, establishing reverse shells, modifying local databases, or exfiltrating environment variables containing sensitive credentials.\nThe impact of successful exploitation is catastrophic, as it leads to Remote Code Execution (RCE). Since the vulnerability allows for direct interaction with the host operating system, post-exploitation behavior typically includes credential harvesting from the local environment, persistence installation, and potential escalation of privileges if the agno-agi process is running with elevated permissions.\nThe vulnerability is remotely exploitable and does not explicitly require prior authentication to reach the vulnerable endpoint, depending on the specific application configuration. Given the public nature of the exploit, any instance of agno-agi up to version 3.0.6 exposed to a network is at immediate risk."
}