Description

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-10-12T09:16:43.243Z",
  "pubdate": "2026-10-12T09:16:43.243Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in the agno-agi agno library, specifically within the CodingTools component.\nThe vulnerability, present in versions up to 3.0.9, allows an attacker to execute arbitrary system commands on the host operating system.\nThis issue stems from improper sanitization of user-supplied input provided to the command argument within the run_shell function.\nThe flaw can be exploited remotely, potentially granting unauthorized access, data exfiltration, or system compromise depending on the privileges of the executing process.\nGiven the availability of public exploits, the risk of exploitation is high. Users must prioritize upgrading to version 3.0.10 to remediate this vulnerability.",
  "technicalDetails": "The vulnerability resides in libs/agno/agno/tools/coding.py within the agno.CodingTools.run_shell function. The root cause is the insecure handling of the 'command' argument, which is passed directly to the underlying system shell without adequate sanitization, validation, or escaping.\nBecause the function acts as an interface for shell command execution, it fails to implement necessary safety boundaries between user-controlled data and the command interpreter. By manipulating the input parameter, an attacker can append malicious shell metacharacters (such as semicolon, pipe, or logical operators) to the intended command, thereby tricking the interpreter into executing secondary, unauthorized commands.\nThe attack flow initiates when an attacker triggers a call to agno.CodingTools.run_shell with a specially crafted string designed to break out of the intended command structure. Because this component is reachable remotely in exposed environments, an attacker does not necessarily require local filesystem access to trigger the execution vector.\nSuccessful exploitation results in arbitrary code execution with the permissions of the application process. This allows for post-exploitation activities including, but not limited to, unauthorized read/write access to sensitive files, establishment of reverse shells, pivot attacks within the network, or persistent system compromise.\nThis vulnerability affects all versions of agno up to 3.0.9. The patch identified as ed64fab5be63d2b15faddc2ef7c733176daa14aa resolves the vulnerability by implementing robust input handling in the run_shell function."
}