Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-79696

Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud Agent Development Kit (ADK) for Python

Default version status: unaffected

  • 2.0.0 to < 2.7.0affected

References