CVE-2026-37003

Agno, an open-source Python framework for building AI agents, is vulnerable to remote code execution (CWE-94) in versions up to and including 2.5.8. The PythonTools and ShellTools components hand unsanitized, LLM-generated arguments directly to execution sinks such as exec(), runpy.run_path(), and subprocess.run(), so an attacker can plant malicious instructions in content the agent processes (e.g., web pages or documents) and cause arbitrary code or OS commands to run on the host server. A successful attack yields full code execution on the server running the agent, with high impact to confidentiality, integrity, and availability, and does not require authentication or direct access to the target. Any deployment of Agno 2.5.8 or earlier whose agents use PythonTools or ShellTools and consume untrusted content is affected. There is currently no known exploitation in the wild, no public proof-of-concept, and it is not in CISA KEV; EPSS estimates a 1.6% chance of exploitation within 30 days.

What to do: Upgrade Agno beyond 2.5.8 as soon as a patched release is available, since no fixed version is specified in the available data. As interim mitigations, disable or restrict PythonTools/ShellTools in agents that process untrusted content, sanitize or constrain LLM-generated arguments before they reach exec(), runpy.run_path(), or subprocess.run(), and run agent execution in a sandbox with limited host and network access. Audit deployments for agents ingesting external content (web pages, documents) with code-execution tools enabled, and monitor for signs of command execution on those hosts.