[New Advisory] Shell Command Injection via Heredoc Escape in agno DaytonaTools.create_file

[hacnho]

Advisory Details

Package: agno (pip)
Repository: https://github.com/agno-agi/agno
CWE: CWE-78 (OS Command Injection)
Severity: High

Summary

DaytonaTools.create_file inserts user-supplied content into a heredoc shell command. A literal EOF in the content breaks the heredoc boundary, and subsequent lines execute as shell commands.

Details

The create_file method constructs a shell command using heredoc syntax to write file content:

cat << 'EOF' > {filepath}
{content}

2. The heredoc closes at the injected EOF, and curl ... | bash executes as a shell command

Impact

Remote code execution on the Daytona workspace. An attacker who can influence file content (e.g., through an AI agent processing untrusted input) can execute arbitrary shell commands.