CVE-2026-37003

Remote code execution via unsanitized LLM prompts in Agno (≤2.5.8) components.

• CVSS 9.8
• 94
• Input Validation and Sanitization
• Remote

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.

CVE

CVE-2026-37003

CWE

94

CVSS base score

9.8

Published

2026-08-27

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Agno

Solution

Upgrade Agno to version 2.5.9 (or later), which patches the prompt‑injection RCE vulnerability.

import subprocess

class ShellTools:
    def __init__(self, llm):
        self.llm = llm

    def run_user_command(self, prompt):
        # VULNERABLE: passes LLM‑generated text directly to subprocess.run
        cmd = self.llm.generate(prompt)  # returns a string like "ls -la"
        subprocess.run(cmd, shell=True, check=True)

import subprocess
import shlex

class ShellTools:
    def __init__(self, llm):
        self.llm = llm

    def run_user_command(self, prompt):
        # FIX: sanitize LLM output before execution
        raw_cmd = self.llm.generate(prompt)  # e.g., "ls -la"
        # split into tokens safely and avoid shell=True
        cmd_args = shlex.split(raw_cmd)
        subprocess.run(cmd_args, check=True)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202637003,
  title        = {{Remote code execution via unsanitized LLM prompts in Agno (≤2.5.8) components.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-37003},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-37003/}}
}