Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

agno

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1PyPIAmendedPublished

    Agno session state overwrites between different sessions/users

    CVE-2025-64168 · GHSA-vw84-hprm-cxmm

    Affected
    • PyPI agno >= 2.0.0, < 2.2.2
    Fixed in
    2.2.2· Vendor fix available
    Issue
    Impact Under certain conditions (under high concurrency), when sessionstate is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a sessionstate to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. Patches This has been patched in version 2.2.2. Upgrade with pip install -U agno.

    Recommended action: Upgrade to 2.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →