Three hours after a separate CVE burst hit MCP servers, a second mass disclosure landed on the AI agent stack. Six CVEs, all assigned by [email protected], published between 20:17:41.107 and 20:17:41.843 UTC — a 0.74-second spread — all pointing at one researcher's disclosure site. They target Agno, LiteLLM, gpt-researcher, crewai-tools and PentestGPT.
The one that matters
CVE-2026-37004: "BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment." LiteLLM is a proxy that thousands of teams run in front of their models.
The fix is real and present in the current code: prompt_manager.py now imports ImmutableSandboxedEnvironment with the inline comment "Sandboxed env: templates can come from user input via /prompts/test." It traces to commit d910a956, dated 9 April 2026, whose title is "fix(proxy): improve input validation on management endpoints." The diff swaps Environment( for ImmutableSandboxedEnvironment(. There was no advisory, no CVE and no mention anywhere in that commit subject of template injection or remote code execution. Version 1.82.4 was published to PyPI on 18 March; current is 1.98.0.
What the common framing gets wrong
The quotable line is "unauthenticated RCE in LiteLLM, disclosed 27 August." The date that matters is 9 April. For 140 days anyone reading LiteLLM's changelog to decide whether to upgrade had nothing to go on — the most serious security fix of the release was described in the register of a lint cleanup.
The Agno entry fails in the opposite direction. It is filed against documented, intended, still-shipping behaviour. "Up to and including 2.5.8" implies a fixed 2.5.9; there is none. runpy.run_path(...) and exec(code, self.safe_globals, self.safe_locals) are in main today, across a major version bump to 3.0.1, under the library's own runtime warning: "PythonTools can run arbitrary code, please provide human supervision." A tool whose purpose is running model-written Python is not an unpatched RCE, and the version ceiling manufactures a patch that does not exist.
Six disclosures, zero severity
The metrics block on all six is empty. No CVSS from MITRE, none from the researcher, none from NVD. An unauthenticated RCE in a widely deployed proxy and a hardcoded telemetry credential in PentestGPT land in the database formally equal, and downstream scanners will either drop them or invent a number. Two entries also pin a release candidate — <= 1.10.2rc1 — as the affected ceiling, against a current crewai-tools of 1.15.18, which no dependency resolver can act on.