~ / search / GHSA-vw84-hprm-cxmm

GHSA-vw84-hprm-cxmm

Agno session state overwrites between different sessions/users

Source: GitHub Advisory Database (reviewed) High CVE-2025-64168

Packages

EcosystemPackageAffectedFixed in
PyPI agno >= 2.0.0, < 2.2.2 2.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Under certain conditions (under high concurrency), when `session_state` is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a `session_state` to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. ### Patches This has been patched in version 2.2.2. Upgrade with `pip install -U agno`.

References

External links from the advisory. They lead to third-party sites.