CriticalVulnerabilityLLM-specific
CVE-2026-37003: Agno RCE via prompt injection in PythonTools and ShellTools
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-37003
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.3%
Summary
Agno up to and including 2.5.8 contains CVE-2026-37003, a remote code execution flaw reached through prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to exec(), runpy.run_path() and subprocess.run(). An unauthenticated attacker can embed malicious instructions in content the agent processes, such as web pages or documents, and gain arbitrary code and OS command execution on the host server.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- InfoSecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoSecuring Web Agents with the Compile-Then-Execute ParadigmSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoWhen File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office DocumentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)