CVE-2026-37003 Code injection in n/a
Agno library allows remote code execution via prompt injection in PythonTools and ShellTools, enabling attackers to run arbitrary commands on the host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-37003?
CVE-2026-37003 is a critical code injection vulnerability in n/a, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
Weakness: CWE-94
Which versions are affected by CVE-2026-37003?
How do I fix CVE-2026-37003?
No fix has been published for CVE-2026-37003 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-37003 being exploited?
There is no known exploitation of CVE-2026-37003 in the wild and no public exploit code.
Sources
Also known as GHSA-g3w9-2xgv-r24v.