id: PYSEC-2026-2333
published: "2026-07-13T15:19:13.948839Z"
modified: "2026-07-13T16:03:11.951594Z"
aliases:
- CVE-2026-10105
- GHSA-82m5-3pcp-hccq
summary: agno contains a SQL injection vulnerability
details: agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.py to delete all rows, target specific rows, or extract information through error-based or blind SQL injection techniques.
affected:
- package:
    name: agno
    ecosystem: PyPI
    purl: pkg:pypi/agno
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 2.6.5
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.8
  - 1.1.0
  - 1.1.1
  - 1.1.10
  - 1.1.11
  - 1.1.12
  - 1.1.13
  - 1.1.14
  - 1.1.15
  - 1.1.16
  - 1.1.17
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.1.7
  - 1.1.8
  - 1.1.9
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.11
  - 1.2.12
  - 1.2.13
  - 1.2.14
  - 1.2.15
  - 1.2.16
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.4.0
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.5.0
  - 1.5.1
  - 1.5.10
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.8
  - 1.5.9
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.7.0
  - 1.7.1
  - 1.7.10
  - 1.7.11
  - 1.7.12
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 1.7.9
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 2.0.0
  - 2.0.0a1
  - 2.0.0rc1
  - 2.0.0rc2
  - 2.0.1
  - 2.0.10
  - 2.0.11
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0.9
  - 2.1.0
  - 2.1.1
  - 2.1.10
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.1.5
  - 2.1.6
  - 2.1.7
  - 2.1.8
  - 2.1.9
  - 2.2.0
  - 2.2.1
  - 2.2.10
  - 2.2.11
  - 2.2.12
  - 2.2.13
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.3.0
  - 2.3.1
  - 2.3.10
  - 2.3.11
  - 2.3.12
  - 2.3.13
  - 2.3.14
  - 2.3.15
  - 2.3.16
  - 2.3.17
  - 2.3.18
  - 2.3.19
  - 2.3.2
  - 2.3.20
  - 2.3.21
  - 2.3.22
  - 2.3.23
  - 2.3.24
  - 2.3.25
  - 2.3.26
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.3.6
  - 2.3.7
  - 2.3.8
  - 2.3.9
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.5.0
  - 2.5.1
  - 2.5.10
  - 2.5.11
  - 2.5.12
  - 2.5.13
  - 2.5.14
  - 2.5.15
  - 2.5.16
  - 2.5.17
  - 2.5.2
  - 2.5.3
  - 2.5.4
  - 2.5.5
  - 2.5.6
  - 2.5.7
  - 2.5.8
  - 2.5.9
  - 2.6.0
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-10105
- type: WEB
  url: https://github.com/agno-agi/agno/issues/7866
- type: WEB
  url: https://github.com/agno-agi/agno/pull/7883
- type: WEB
  url: https://github.com/agno-agi/agno/pull/7883/changes/26a7439b803c0ccc9a58ee53572d8088a678923f
- type: WEB
  url: https://github.com/agno-agi/agno/pull/7883/changes/a0ec99305e782e68ba26f5966c53ad50b5f40132
- type: PACKAGE
  url: https://github.com/agno-agi/agno
- type: WEB
  url: https://www.vulncheck.com/advisories/agno-sql-injection-via-clickhouse-delete-by-metadata
- type: PACKAGE
  url: https://pypi.org/project/agno
- type: ADVISORY
  url: https://github.com/advisories/GHSA-82m5-3pcp-hccq
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N