agno-agi Command Injection Vulnerability in Model Context Protocol Handler

A critical OS command injection vulnerability has been identified in agno-agi versions through 1.7.5. The issue arises in the Model Context Protocol Handler, specifically within the MCPTools and MultiMCPTools functions of the mcp.py library. The vulnerability allows remote execution of arbitrary commands by manipulating the 'command' argument, which is improperly validated before being executed. This exploitation occurs with the privileges of the Agno agent process.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the server where the Agno agent is running.

Reproduction

To reproduce this vulnerability, send a request to the Agno framework's MCPTools or MultiMCPTools functions with a crafted 'command' argument. The input will be processed by 'shlex.split()' and executed as a system command, without any sanitization, leading to command injection.