Login Request a demo
Medium severity · published Oct 12, 2026
CVE-2026-108816
agno-agi agno PythonTools python.py run_python_code code injection
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
agno · agno-agi
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +1 more · source: vendor
Affected product
AG
agno
agno-agi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108816
vdb-entry
https://vuldb.com/vuln/416593
signature
https://vuldb.com/vuln/416593/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-108816
third-party-advisory
https://vuldb.com/submit/964159
issue-tracking
https://github.com/Agno-agi/Agno/issues/10047
exploit
https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-pythontools-run-python-code-arbitrary-code-execution.md
More from agno
8.8
CVE-2026-76832
Agno PythonTools Path Traversal via joinpath file_name argument
8.3
CVE-2026-10105
agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()
8.1
CVE-2026-119050
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
7.3
CVE-2026-108819
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
7.3
CVE-2026-108818
agno-agi agno auth.py get_authentication_dependency missing authentication