Path Traversal Vulnerability in Agno's PythonTools Software
CVE-2026-76832

8.5HIGH

Key Information:

Vendor

Agno Agi

Status
Agno
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76832?

Agno's PythonTools library in libs/agno/agno/tools/python.py contains a significant path traversal vulnerability. By exploiting this flaw, attackers can perform unauthorized actions such as reading, writing, or executing files on the host system. This is accomplished by manipulating the file_name argument in functions like read_file, save_to_file, or run_python_file with parent-directory traversal sequences. Attackers may deliver these sequences directly or through injected prompts within user content, effectively bypassing security measures and exposing the system to arbitrary file manipulation and execution under the user’s privileges.

Affected Version(s)

Agno 0 <= 710d7e7

References

https://github.com/agno-agi/agno
product
https://github.com/agno-agi/agno/commit/710d7e7f846f93b7a...
patch
https://www.vulncheck.com/advisories/agno-pythontools-pat...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Raza (GitHub Username: locus-x64)
.