The Agno agent framework passed model output straight into exec()

What happened

Agno up to 2.5.8 passed unsanitised, model-generated arguments from its PythonTools and ShellTools components directly into exec(), runpy.run_path() and subprocess.run(). Instructions planted in anything the agent read, a web page or a document, reached code and command execution on the host with no authentication.

NVD scores it 9.8 critical. The framework treated model output as trusted input to an interpreter, which removes any distinction between what the agent was asked to do and what a document it happened to read told it to do.