CVE-2026-108816

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108816
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108816.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108816
Published
2026-10-12T08:30:18Z
Modified
2026-10-14T02:46:59Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
agno-agi agno PythonTools python.py run_python_code code injection
Details

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108816.json"
}
References

Affected packages

Git / github.com/agno-agi/agno

Affected ranges

Type
GIT
Repo
https://github.com/agno-agi/agno
Events
Introduced
474836be8d1c103ce6168f4961c22439f2b575a9
Last Affected
d1a388446e1b44b20498c772e91303588e2734cf
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "last_affected":  "3.0.0"
        },
        {
            "introduced":  "3.0.1"
        },
        {
            "last_affected":  "3.0.1"
        },
        {
            "introduced":  "3.0.2"
        },
        {
            "last_affected":  "3.0.2"
        },
        {
            "introduced":  "3.0.3"
        },
        {
            "last_affected":  "3.0.3"
        },
        {
            "introduced":  "3.0.4"
        },
        {
            "last_affected":  "3.0.4"
        },
        {
            "introduced":  "3.0.5"
        },
        {
            "last_affected":  "3.0.5"
        },
        {
            "introduced":  "3.0.6"
        },
        {
            "last_affected":  "3.0.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108816.json"