Agenta に Python Sandbox Escape が存在し、リモートコード実行 (RCE) へと繋がる

An attacker exploiting this vulnerability could gain complete control over the Agenta API server. By injecting malicious code through the evaluator, they could execute arbitrary commands, access sensitive data, and potentially compromise the entire system. The attack path leverages the numpy.ma.core.inspect function, which exposes Python's introspection utilities, providing access to un-filtered modules. This effectively bypasses the intended sandboxing, allowing for unrestricted code execution. The potential impact includes data breaches, system takeover, and denial of service.

Organizations deploying Agenta API in production environments, particularly those with user-supplied code evaluation features, are at risk. Shared hosting environments where multiple users have access to the Agenta API server are also particularly vulnerable, as a compromised user could potentially exploit the vulnerability to impact other users on the same server.

• python / server:

import os
import subprocess

def check_agenta_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'agenta'], stderr=subprocess.STDOUT)
        version = result.decode('utf-8').split('Version: ')[1].strip()
        if version <= '0.48.1':
            print("Agenta version is vulnerable!")
        else:
            print("Agenta version is patched.")
    except FileNotFoundError:
        print("Agenta is not installed.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking Agenta version: {e}")

check_agenta_version()

• linux / server:

ps aux | grep -i agenta
# Check for unusual processes or arguments related to code evaluation

1. 2026-02-26Disclosure

   disclosure

1. 予約済み2026-02-25
2. 公開日2026-02-26
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-27952 is to immediately upgrade Agenta API to version 0.48.1 or later. If upgrading is not immediately feasible, consider implementing stricter input validation and sanitization for any user-supplied code passed to the evaluator. While a direct workaround is not available, limiting network access to the Agenta API server can reduce the potential blast radius of a successful exploit. Review and audit all custom code evaluators for similar misconfigurations.