CVE-2025-64168: 
Python vulnerability analysis and mitigation

Agno, a multi-agent framework, runtime and control plane, contains a vulnerability (CVE-2025-64168) affecting versions 2.0.0 to 2.2.2. The vulnerability was disclosed on October 31, 2025, and involves a race condition that can occur under high concurrency when session_state is passed to Agent or Team during run or arun calls (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with a vector string of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The issue is classified under two CWE categories: CWE-362 (Race Condition) and CWE-668 (Exposure of Resource to Wrong Sphere). The vulnerability manifests as a race condition during concurrent operations, where shared resources are improperly synchronized (GitHub Advisory).

When exploited, this vulnerability can cause session_state to be assigned and persisted to the incorrect session, potentially exposing user data from one session to another user. This represents a significant privacy and security concern as it can lead to unauthorized access to user information (GitHub Advisory).

The vulnerability has been patched in version 2.2.2 of Agno. Users are advised to upgrade to this version using the command 'pip install -U agno' (GitHub Advisory).