Description (CNA)
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Google Cloud / Agent Development Kit (ADK) for Python | affected 2.0.0 before 2.7.0 |
CWE
CWE-184
References
- https://github.com/google/adk-python/releases/tag/v2.7.0
- https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d
ADP enrichment
No English description supplied.
No references supplied.