Threat · curated 10 Sep 2026
NVD-CVE-2026-37003
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-37003 shows how indirect prompt injection into an AI agent's tool-calling can escalate straight to unauthenticated RCE on the host, a serious risk for anyone deploying Agno-based agents that process untrusted content.
CVE-2026-37003 is a critical (CVSS 9.8) remote code execution vulnerability in the Agno agent framework up to and including 2.5.8. Its PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly into execution sinks including exec(), runpy.run_path(), and subprocess.run(), allowing an unauthenticated attacker to embed malicious instructions in content the agent processes (such as web pages or documents) to achieve arbitrary code and OS command execution on the host.
Summary
CVE-2026-37003 is a critical Remote Code Execution vulnerability in the Agno agent framework affecting all versions up to and including 2.5.8. The flaw arises because the PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly into execution sinks such as exec(), runpy.run_path(), and subprocess.run().[0]
An unauthenticated attacker can exploit the vulnerability through prompt injection by embedding malicious instructions in content processed by the agent, such as web pages or documents, achieving arbitrary code and OS command execution on the host server. CISA-ADP rated the issue CVSS 3.1 9.8 (CRITICAL) and classified it as CWE-94. The evidence available is a vulnerability disclosure record with no indication of in-the-wild exploitation or a named actor.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Aug 27, 2026 | CVE-2026-37003 published to the National Vulnerability Database (source: MITRE).[0] |
| Sep 08, 2026 | NVD record last modified; CISA-ADP CVSS 9.8 scoring and CWE-94 mapping present.[0] |
How it works
The Agno framework's PythonTools and ShellTools components take arguments generated by the LLM and pass them, unsanitized, directly to code and command execution sinks including exec(), runpy.run_path(), and subprocess.run(). Because the LLM output is not validated or sandboxed, an attacker who can influence the content the agent processes (for example a web page or document containing hidden malicious instructions) can inject code through prompt injection. This constitutes CWE-94 (Improper Control of Generation of Code) and enables arbitrary code and OS command execution on the host, without authentication.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Agno (agno.com) | All versions up to and including 2.5.8 | No patch or fixed version identified in the available evidence.[0] |
Key takeaways
- Passing unsanitized LLM-generated output directly to code execution sinks creates a critical, unauthenticated RCE path exploitable via prompt injection, as demonstrated by Agno's PythonTools and ShellTools (CVE-2026-37003, CVSS 9.8).[0]
- Agent frameworks must sandbox or validate any LLM-controlled arguments before they reach exec(), runpy, or subprocess calls; the CWE-94 mapping underscores code-injection as the root cause.[0]
Defensive actions
- Restrict or sandbox the execution sinks used by Agno's PythonTools and ShellTools, and avoid passing unsanitized LLM-generated arguments to exec(), runpy.run_path(), or subprocess.run().: The vulnerability stems from unsanitized LLM output reaching code and command execution sinks, enabling unauthenticated RCE via prompt injection.[0]
- Treat all external content processed by Agno agents (web pages, documents) as untrusted and constrain agent tool permissions.: Attackers exploit the flaw by embedding malicious instructions in content the agent ingests, so limiting agent capabilities reduces exploitability.[0]