A critical sandbox escape vulnerability in Agenta-API allows authenticated users to achieve arbitrary remote code execution on the host server.

The vulnerability is a code injection flaw (CWE-94) resulting from an improper RestrictedPython sandbox configuration. Authenticated users can exploit the incorrectly whitelisted numpy package to access system-level introspection utilities, facilitating arbitrary command execution.

The ability for an authenticated user to execute arbitrary code on the API server poses a severe risk to the entire infrastructure. This could lead to a total compromise of the platform, including unauthorized data access, lateral movement within the network, and the potential for persistent backdoors. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that necessitates immediate remediation to prevent system-wide exploitation.

Immediate Action: Update the Agenta-API component to version 0.48.1 or later immediately to remove the vulnerable package from the sandbox allowlist.

Proactive Monitoring: Monitor API server logs for unusual process execution or attempts to access system-level modules, such as os or sys, via the evaluator interface.

Compensating Controls: If immediate patching is not feasible, restrict access to the custom code evaluator functionality to trusted users only and implement strict egress filtering on the API server to prevent reverse shells.

Public Exploit Available: Unknown

Given the potential for remote code execution and the confirmed existence of proof-of-concept material, organizations running self-hosted Agenta-API instances must prioritize this update. Administrators should verify their current version and apply the patch to version 0.48.1 without delay to neutralize this critical injection vector.