Skip to content

Translation in progress Some entries still include text in the original language.

EventPast event

Agno ≤2.5.8 因提示注入致远程代码执行

1 reports1 reporting sources

Start here

AI overview

MITRE 记录的 CVE-2026-37003 显示，Agno 2.5.8 及以下版本存在远程代码执行漏洞。PythonTools 与 ShellTools 组件把 LLM 生成且未经清洗的参数直接传给 exec()、runpy.run_path() 和 subprocess.run() 等执行入口，攻击者只需把恶意指令嵌入 Agent 处理的网页或文档等内容即可触发，无需认证，可在宿主服务器上执行任意代码和系统命令。

Generated by AI from reports · Updated 8 days ago

Progress timeline

Date not provided
  1. Date not given
    OpenCVESelected
    Agno 2.5.8 及以下版本因提示注入可致远程代码执行（CVE-2026-37003）

    MITRE 记录的 CVE-2026-37003 显示，Agno 2.5.8 及以下版本存在远程代码执行漏洞，攻击者可借提示注入在宿主服务器上执行任意代码和系统命令。PythonTools 与 ShellTools 组件把 LLM 生成且未经清洗的参数直接传给 exec()、runpy.run_path() 和 subprocess.run() 等执行入口，攻击者只需把恶意指令嵌入 Agent 处理的网页或文档等内容即可触发，且无需认证。该漏洞 CVSS v3.1 评分为 9.8，属严重级别，EPSS 为 0.01321，未被列入 CISA KEV 目录，CWE 归类为 CWE-94 代码注入。

Related discussion

No discussion links have been collected for this event yet.

Attention trend

New sources per day

9 days total1 ·Maximum1（Oct 5）·Today0

  • Oct 5New1 sources (1 outlets,0 accounts)
  • Oct 6New0 sources (0 outlets,0 accounts)
  • Oct 7New0 sources (0 outlets,0 accounts)
  • Oct 8New0 sources (0 outlets,0 accounts)
  • Oct 9New0 sources (0 outlets,0 accounts)
  • Oct 10New0 sources (0 outlets,0 accounts)
  • Oct 11New0 sources (0 outlets,0 accounts)
  • Oct 12New0 sources (0 outlets,0 accounts)
  • Oct 13New0 sources (0 outlets,0 accounts)

Hourly attention

No comparable trend data