CVE-2026-108817
mediumA vulnerability was determined in agno-agi agno up to 3.0.9.
A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Agno-agi/Agno/ cna@vuldb.com
- https://github.com/Agno-agi/Agno/issues/10048 cna@vuldb.com
- https://github.com/agno-agi/agno/commit/ed64fab5be63d2b15faddc2ef7c733176daa14aa cna@vuldb.com
- https://github.com/agno-agi/agno/pull/10210 cna@vuldb.com
- https://github.com/agno-agi/agno/releases/tag/v3.0.10 cna@vuldb.com
- https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-codingtools... cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-108817 cna@vuldb.com
- https://vuldb.com/submit/964160 cna@vuldb.com
- https://vuldb.com/submit/964161 cna@vuldb.com
- https://vuldb.com/vuln/416594 cna@vuldb.com
- https://vuldb.com/vuln/416594/cti cna@vuldb.com
- https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-codingtools... 134c704f-9b21-4f2e-91b3-4a467353bcc0