CVE-2026-79696

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79696

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79696.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79696

Published

2026-09-09T09:17:11Z

Modified

2026-09-11T08:26:28Z

Severity

10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber CVSS Calculator

Summary

[none]

Details

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

References

Affected packages

Git / github.com/google/adk-python

Affected ranges

Type

GIT

Repo

https://github.com/google/adk-python

Events

Introduced

0a290d574303ad79d25d7f2ecb5d118ff5118e95

Fixed

a5791dab0b1aeae88caab31ca6951653dcdbba8b

Fixed

a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d

Fixed

25e8ea6dea82713fdac9bc4117ec425386582b1f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79696.json"