{"action":"Upgrade agenta to 0.86.8 or later.","affected":[{"fixed":"0.86.8","introduced":"0"}],"component":"agenta","cve_ids":["CVE-2026-27961"],"ecosystem":"PyPI","epss":0.00361,"exploited":false,"fixed_versions":["0.86.8"],"ghsa_id":"GHSA-cfr2-mp74-3763","id":"tcs_01M5KHCZQ7MWASMA5W5T6CNH63","modified_at":"2026-05-20T09:18:51.078113Z","published_at":"2026-02-26T02:16:23.483Z","references":["https://osv.dev/vulnerability/PYSEC-2026-7","https://github.com/Agenta-AI/agenta/security/advisories/GHSA-cfr2-mp74-3763"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-7","url":"https://osv.dev/vulnerability/PYSEC-2026-7"}],"summary":"Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vul"}