Agenta is an open‑source LLMOps platform that contains a Server‑Side Template Injection flaw in its API server evaluator. The vulnerable code resides in the SDK package but is executed on the server when evaluators run, allowing an attacker to inject Jinja2 template expressions that the server will interpret, potentially leading to arbitrary code execution on the host. This issue is limited to self‑hosted or managed Agenta deployments; usage of the standalone SDK is not affected.

Vendor Agenta‑AI’s Agenta product, affected in every released version prior to 0.86.8. The fix is included in version 0.86.8 and later.

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. The EPSS score is below 1%, suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. The likely attack vector involves an actor who can supply or influence evaluator templates, such as through a constructed API request. On a misconfigured or unauthenticated exposure of the evaluator endpoint, the attacker could trigger code execution from the server side.