CVE-2026-27952

{
  "id": "CVE-2026-27952",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27952",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-26T19:27:13.151791Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Agenta-AI",
          "product": "agenta-api",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.48.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T02:16:22.940",
  "references": [
    {
      "url": "https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pmgp-2m3v-34mq",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python's introspection utilities — including `sys.modules` — thereby providing access to unfiltered system-level functionality like `os.system`. This vulnerability affects the Agenta self-hosted platform (API server), not the SDK when used as a standalone Python library. The custom code evaluator runs server-side within the API process. The issue is fixed in v0.48.1 by removing `numpy` from the sandbox allowlist. In later versions (v0.60+), the RestrictedPython sandbox was removed entirely and replaced with a different execution model."
    },
    {
      "lang": "es",
      "value": "Agenta es una plataforma LLMOps de código abierto. En Agenta-API, antes de la versión 0.48.1, existía una vulnerabilidad de escape de sandbox de Python en el evaluador de código personalizado de Agenta. Agenta utilizaba RestrictedPython como mecanismo de sandboxing para el código de evaluador proporcionado por el usuario, pero incluyó incorrectamente el paquete 'numpy' en la lista blanca como seguro dentro del sandbox. Esto permitía a los usuarios autenticados eludir el sandbox y lograr la ejecución de código arbitrario en el servidor API. La ruta de escape fue a través de 'numpy.ma.core.inspect', que expone las utilidades de introspección de Python —incluyendo 'sys.modules'—, proporcionando así acceso a funcionalidades a nivel de sistema sin filtrar como 'os.system'. Esta vulnerabilidad afecta a la plataforma autoalojada de Agenta (servidor API), no al SDK cuando se utiliza como una librería Python independiente. El evaluador de código personalizado se ejecuta en el lado del servidor dentro del proceso API. El problema se solucionó en la v0.48.1 eliminando 'numpy' de la lista de permitidos del sandbox. En versiones posteriores (v0.60+), el sandbox de RestrictedPython se eliminó por completo y se reemplazó por un modelo de ejecución diferente."
    }
  ],
  "lastModified": "2026-06-17T10:27:58.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:agentatech:agenta:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97DA97AA-00E2-48A5-8EEE-2F922094E66F",
              "versionEndExcluding": "0.48.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}