Description

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool actions. Attackers can inject traversal sequences such as '../../../../../../etc/passwd' through direct tool invocation or via prompt injection embedded in agent-processed content to escape the intended base_dir boundary and achieve arbitrary file read, arbitrary file write, or arbitrary Python code execution within the process user's authority.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:27.960Z",
  "pubdate": "2026-08-19T22:17:27.960Z",
  "executiveSummary": "A path traversal vulnerability exists in Agno within libs/agno/agno/tools/python.py, specifically affecting the PythonTools implementation.\nThe vulnerability allows malicious actors to perform arbitrary file read, arbitrary file write, or arbitrary Python code execution under the privileges of the running process.\nThe flaw impacts systems utilizing the read_file, save_to_file, or run_python_file tool actions provided by Agno.\nAttackers can exploit this issue either through direct invocation of the vulnerable tool actions or indirectly via prompt injection embedded within content processed by AI agents.\nBy supplying parent-directory traversal sequences such as '../../../../../../etc/passwd' in the file_name argument, an attacker can successfully bypass the intended base_dir security boundary.\nThe risk implications are severe, as successful exploitation grants complete filesystem access and code execution capabilities within the context of the application process user.",
  "technicalDetails": "The vulnerability resides in the libs/agno/agno/tools/python.py file of the Agno product, specifically within the functions handling file and script operations.\nThe vulnerable component comprises the read_file, save_to_file, and run_python_file tool actions, which accept a file_name parameter from the user or agent workflow.\nThe root cause of the vulnerability is the insufficient validation, sanitization, and normalization of the file_name argument prior to performing filesystem operations.\nBecause path boundaries are not strictly enforced against directory traversal sequences, input containing relative navigation patterns like '../' allows the resolution mechanism to escape the intended base_dir restriction.\nExploitation occurs step-by-step when an attacker crafts a malicious payload containing traversal sequences, such as '../../../../../../etc/passwd', and passes it to the target tool action.\nThis payload can be delivered either via direct API or CLI tool invocation by an authenticated or unauthenticated user depending on exposure, or autonomously triggered when an AI agent parses untrusted data containing a prompt injection payload.\nOnce processed, the read_file function retrieves arbitrary files from the host filesystem, save_to_file writes arbitrary content to sensitive system or application paths, and run_python_file executes arbitrary Python scripts located outside the designated directory.\nThe post-exploitation impact includes full confidentiality and integrity compromise of the underlying filesystem, alongside potential Remote Code Execution (RCE) via arbitrary Python script execution within the process user's authority."
}