CVE-2026-108816

Deferred Deferred - Pending Action

Code Injection in agno Python Tools

Publication date: 2026-10-12

Last updated on: 2026-10-15

Assigner: VulDB

Description

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108816

EUVD

EUVD-2026-97299

Affected Vendors & Products

Vendor	Product	Version / Range
agno-agi	agno	3.0.0
agno-agi	agno	3.0.1
agno-agi	agno	3.0.2
agno-agi	agno	3.0.3
agno-agi	agno	3.0.4
agno-agi	agno	3.0.5
agno-agi	agno	3.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-108816 is a critical code injection vulnerability in the agno library's PythonTools component. The run_python_code function in python.py allows arbitrary code execution due to improperly restricted execution namespaces. The safe_globals and safe_locals parameters default to the interpreter's full globals() and locals(), including dangerous built-ins like __import__. Attackers can exploit this to execute malicious Python code with the host process privileges.

Detection Guidance

Check if your system uses agno library versions up to 3.0.6 by inspecting installed packages. Look for processes calling the run_python_code function in PythonTools. Monitor for unusual exec() calls or unexpected network connections from Python processes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code remotely or locally, depending on deployment. Potential impacts include file read/write operations, secret theft, unauthorized network connections, and process termination. Systems using agno up to version 3.0.6 are at risk if they process untrusted data or embed agno in agent-based systems.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade agno to a patched version if available. If no patch exists, restrict access to the run_python_code function, disable untrusted input processing, or isolate Python execution in a sandbox. Avoid passing untrusted data to this function.

Hi! I’m here to help you understand CVE-2026-108816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70