CVE-2026-108819CWE-913

CVE-2026-108819

High · published October 12, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00314 · 23.1th percentile
Weakness
CWE-913 · Improper Control of Dynamically-Managed Code Resources
Published
2026-10-12T14:16Z
References (8)
https://github.com/Agno-agi/Agno/ · [email protected]https://github.com/Agno-agi/Agno/issues/10053 · [email protected]https://github.com/agno-agi/agno/pull/10523 · [email protected]https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-agent-orchestration-missing-confirmation-gate-code-execution.md · [email protected]https://vuldb.com/cve/CVE-2026-108819 · [email protected]https://vuldb.com/submit/964164 · [email protected]https://vuldb.com/vuln/416596 · [email protected]https://vuldb.com/vuln/416596/cti · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 12 OCT 09:15Z
    agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
    cvelistv5
  • 12 OCT 09:15Z
    agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
    cvelistv5