CVE-2026-108817 Details
Description
A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.
A command injection vulnerability has been identified in the Agno-agi framework, specifically in the CodingTools component, versions through 3.0.6. The issue arises in the run_shell function, located in the file libs/agno/agno/tools/coding.py. The vulnerability allows for arbitrary OS command execution by bypassing the application's command validation. This is achieved by encoding the command payload with the chr() function, evading disallowed substrings and exploiting the command execution mechanism. The vulnerability can be exploited remotely through prompt injection into an affected agent.
Users should upgrade to Agno version 3.0.10, where this vulnerability has been patched. In the patched version, the run_shell function no longer defaults to an enabled state, and the command validation has been improved to block inline code execution via interpreters.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| agno-agi agno | <= 3.0.6 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |