Agno's PythonTools module forgives any directory traversal characters in the file_name argument for its read_file, save_to_file, or run_python_file actions. This flaw permits an attacker to read sensitive files, overwrite arbitrary filesystem locations, or execute arbitrary Python code with the process’s permissions. The vulnerability can be triggered by supplying a crafted file_name directly or by embedding traversal sequences in prompts that the agent processes. The consequence is loss of confidentiality, integrity, and the potential for full process compromise.

The affected product is Agno AGI:Agno, specifically its PythonTools implementation in libs/agno/agno/tools/python.py. No specific version information is supplied; any deployment of the library that incorporates this code path is vulnerable.

With a CVSS score of 8.5, the flaw is classified as highly severe. Exploitation probability information is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can inject the exploit through tool calls or via prompt injection that the agent processes, allowing local or remote exploitation if an attacker can trigger the vulnerable action. The lack of mitigation in the code makes the vulnerability easy to abuse and the potential impact very high.