CVE-2026-108817
Deferred Deferred - Pending Action

Command Injection in agno-agi

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
2026-10-12
NVD
CVE-2026-108817
EUVD
EUVD-2026-97301

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
agno-agi agno 3.0.0
agno-agi agno 3.0.1
agno-agi agno 3.0.2
agno-agi agno 3.0.3
agno-agi agno 3.0.4
agno-agi agno 3.0.5
agno-agi agno 3.0.6
agno-agi agno 3.0.7
agno-agi agno 3.0.8
agno-agi agno 3.0.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108817 is a command injection vulnerability in the agno framework's CodingTools.run_shell() function. It allows attackers to execute arbitrary OS commands with the privileges of the agno process, even when restricted mode is enabled. The issue stems from an incomplete disallowlist of shell operators and the use of subprocess.run(command, shell=True), which can be bypassed by encoding commands using chr() to avoid detection.

Detection Guidance

Check if agno versions up to 3.0.9 are installed using commands like 'pip show agno-agi' or 'agno --version'. Inspect logs for suspicious shell command patterns such as 'python3 -c' or 'python -m' in restricted mode. Monitor network traffic for unexpected outbound connections from agno processes.

Impact Analysis

This vulnerability enables full OS command execution, allowing attackers to read or write files, exfiltrate sensitive data like API keys or database passwords, install malware, achieve persistence, move laterally within the host network, or terminate processes. It can be exploited remotely via prompt injection against a network-exposed agent or directly by calling the toolkit.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as environment variables, API keys, or database passwords, which are often protected under GDPR and HIPAA. Exploitation may result in data breaches, violating compliance requirements for data protection and confidentiality.

Mitigation Strategies

Upgrade agno to version 3.0.10 or later immediately. Disable 'enable_run_shell' by default in configurations. Block interpreter flags like '-c', '-m', and '-e' in restricted mode. Replace shell=True with safer alternatives like subprocess.run(args, shell=False).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart