Agno Turns Prompt Injection Straight Into RCE via PythonTools and ShellTools (CVE-2026-37003)

NVD·high signalXBlueskyLinkedInCopy link

Agno up to and including 2.5.8 passes unsanitized, LLM-generated arguments directly to `exec()`, `runpy.run_path()` and `subprocess.run()` in its PythonTools and ShellTools components, so an unauthenticated attacker who can get text in front of the agent gets code execution. The GitHub advisory published 2026-08-27 at 21:31 UTC. This is Agno's second such disclosure this month after CVE-2026-76832 (8.8), a PythonTools path traversal via the `file_name` argument, which suggests the tool layer rather than any single call site is the problem.