A flaw in the exec function of the Agent Orchestration Layer enables an attacker to manipulate the code argument, causing the system to execute dynamically generated code. This leads to remote code execution, allowing an adversary to run arbitrary commands with the privileges of the service. The weakness stems from improper handling of user-supplied code, aligning with CWE‑913 – Code Injection.

The vulnerability affects agno-agi’s Agno product versions up to 3.0.6 and 3.1.1. Any deployment of these versions that exposes the exec component to external input is at risk.

The CVSS score of 6.9 indicates a medium severity risk; the EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Public exploits have already been released, making remote exploitation feasible through the exposed exec interface, presumably via an API or web endpoint. Given the availability of the exploit code, an attacker can carry out the attack without additional privileged access.