What happened
Published 2026-08-19 (CVSS 8.8, High), this path-traversal vulnerability in a widely-used Python agent-tools library allows an attacker (or a prompt-injected agent) to escape the sandboxed base directory of file-manipulation tool actions.
Why it matters
Agent-tool sandbox-escape via path traversal is one of the most direct ways prompt injection converts into real system compromise — an attacker who can influence tool-call arguments (via injected content in retrieved documents, tool outputs, etc.) can read secrets, overwrite files, or execute arbitrary code outside the intended sandbox boundary.
Attack vector
The read_file, save_to_file, and run_python_file tool actions in Agno's PythonTools fail to sanitize the file_name argument, allowing parent-directory traversal sequences (e.g. ../../../../etc/passwd) to escape the intended base_dir boundary, enabling arbitrary file read, write, or Python code execution outside the sandbox.
Affected systems
Agno (libs/agno/agno/tools/python.py)
Mitigation
Apply the upstream fix in the agno-agi/agno repository; validate and canonicalize file_name arguments against the intended base_dir before any file operation.