Loading story…
A high-severity path traversal flaw tracked as CVE-2026-76832 was disclosed in Agno's PythonTools component, affecting libs/agno/agno/tools/python.py. The vulnerability stems from insufficient validation of the file_name argument in the read_file, save_to_file, and run_python_file actions, allowing attackers to use parent-directory traversal sequences such as ../../ to escape the intended base_dir boundary. Successful exploitation can lead to arbitrary file read, arbitrary file write, or arbitrary Python code execution with the privileges of the running process.
The issue can be triggered through direct tool invocation or indirectly through prompt injection in content processed by an agent, expanding the risk for deployments that expose these capabilities to untrusted input. A related Agno code change introduced stricter path handling, including a restrict_to_base_dir parameter, absolute-path resolution for base_dir, and path checks that reject requests outside the allowed directory, indicating the vulnerability was addressed by enforcing base-directory restrictions on file operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-76832 was published for a path traversal flaw in Agno's PythonTools affecting the read_file, save_to_file, and run_python_file actions via the file_name argument. The advisory says attackers can escape the intended base_dir boundary through direct invocation or prompt injection, leading to arbitrary file read, file write, or Python code execution.
A GitHub commit introduced a new restrict_to_base_dir parameter, resolved base_dir to an absolute path, and changed transcription file handling to validate paths with _check_path before use. The change blocks requests for files outside the allowed base directory, indicating a mitigation for path traversal or unauthorized file access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two application vulnerabilities have exposed AGiXT and Bugsink servers to filesystem-level attacks that can lead to full host compromise. In AGiXT, advisory `GHSA-5gfj-64gh-mgmw` describes an authenticated path traversal flaw in the Essential Abilities Extension, rated **CVSS 8.8**, that lets an attacker escape intended directories and access files with the permissions of the AGiXT process. The issue allows arbitrary read, write, and delete operations against sensitive targets including environment files, configuration data, database credentials, cryptographic keys, `/etc/shadow`, and `.ssh/id_rsa`, creating high risk to confidentiality, integrity, and availability. A separate flaw tracked as `CVE-2026-40162` affects Bugsink and enables authenticated arbitrary file write or overwrite within the application's runtime permissions, with a **CVSS 7.1** rating. The weakness can be used to overwrite Python source files or module initialization scripts so attacker-controlled code executes on restart or when a new worker is spawned, effectively turning file access into remote code execution. Both disclosures warn that deployments running with elevated privileges or broad filesystem access face the greatest danger, including persistence through locations such as cron directories, `.ssh/authorized_keys`, or application package paths, as well as exposure of secrets, telemetry, and backend credentials.
Jun 29, 2026
Tenable disclosed a critical path traversal vulnerability, tracked as **`CVE-2026-15265`**, affecting **Tenable/Nessus Agent** on **Linux, Windows, and macOS**. The flaw allows a privileged attacker to write arbitrary files outside the intended plugin directory, creating a path to **remote code execution**. The issue affects **version 11.2.0** and **11.1.3 and earlier**, and has been classified under **`CWE-22`** and **`CWE-347`** with high impact to confidentiality, integrity, and availability. Tenable released fixes in **versions 11.2.1 and 11.1.4**, and the **Canadian Centre for Cyber Security** issued advisory **AV26-705** urging organizations to review Tenable’s guidance and apply updates. CISA enrichment cited in vulnerability tracking data indicates **no known exploitation** so far, but assessed the technical impact as total, reinforcing the need for rapid patching across exposed agent deployments.
Jul 16, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026