# CVE-2026-108817: agno CodingTools OS command injection in run_shell

Source: https://junglewise.ai/threats/cve-2026-108817-a-vulnerability-was-determined-in-agno-agi-agno-up-to-3-0-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108817 · Severity: medium · CVSS 5.5 · Published 2026-10-12

Agno is an AI agent framework that includes a code execution component. A vulnerability in the CodingTools.run_shell function allows attackers to bypass command restrictions and execute arbitrary OS commands remotely, potentially gaining full system access or executing malicious code on systems running the affected library.

Technologies: [Agno-Agi Agno](https://junglewise.ai/threats/technologies/agno-agi-agno). Vendors: [Agno-Agi](https://junglewise.ai/threats/vendors/agno-agi).

## Quick answers

**Is CVE-2026-108817 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108817 being exploited in the wild.

**How severe is CVE-2026-108817?** Medium severity, with a CVSS score of 5.5, published 12 October 2026.

**Which products and versions are affected?** Agno-Agi Agno up to 3.0.9.

**Is there a fix for CVE-2026-108817?** Yes: fixed in 3.0.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108817 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108817?** Check whether you run Agno-Agi Agno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.10

## Technical details

The vulnerability exists in agno.CodingTools.run_shell (libs/agno/agno/tools/coding.py) where the command argument is inadequately validated, allowing OS command injection through character encoding bypasses of the restricted-mode command allowlist. An unauthenticated remote attacker can craft a malicious command input to escape the restrictions and execute arbitrary shell commands with the privileges of the running process.

## Affected products

- agno-agi agno up to 3.0.9

## Timeline

- 2026-10-12: disclosed
- 2026-10-12: patched: Patch ed64fab5be63d2b15faddc2ef7c733176daa14aa

## References

- [https://github.com/Agno-agi/Agno/](https://github.com/Agno-agi/Agno/)
- [https://github.com/Agno-agi/Agno/issues/10048](https://github.com/Agno-agi/Agno/issues/10048)

## Related threats

- [agno privilege escalation in team delegation feature](https://junglewise.ai/threats/cve-2026-108820-a-weakness-has-been-identified-in-agno-agi-agno-up-to-3-0-6-3-1)
- [agno-agi agno arbitrary code execution in Agent Orchestration Layer](https://junglewise.ai/threats/cve-2026-108819-a-security-flaw-has-been-discovered-in-agno-agi-agno-up-to-3-0-6)
- [agno authentication bypass in get_authentication_dependency](https://junglewise.ai/threats/cve-2026-108818-a-vulnerability-was-identified-in-agno-agi-agno-up-to-2-7-3-3-0)
- [agno PythonTools code injection in run_python_code](https://junglewise.ai/threats/cve-2026-108816-a-vulnerability-was-found-in-agno-agi-agno-up-to-3-0-6-affected)