CVE-2026-37003

Name of the Vulnerable Software and Affected Versions Agno versions prior to 2.5.9

Description Remote Code Execution (RCE) is possible via prompt injection. The PythonTools and ShellTools components pass unsanitized arguments generated by a Large Language Model (LLM) directly to execution sinks, specifically the exec(), runpy.run path(), and subprocess.run() functions. An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent, such as documents or web pages, to execute arbitrary code and operating system commands on the host server.

Recommendations Update to a version newer than 2.5.8. As a temporary mitigation, restrict the use of the PythonTools and ShellTools components.