Patch this one
Google published a 10.0 against its own agent framework, and the fix shipped four weeks before the warning
The precondition is pytest being present in the image, which is the default for anyone who never split development dependencies from runtime ones. Version 2.7.0 closed the hole on 13 August, four weeks before the advisory told anyone it existed, and GitHub still has the record filed as unreviewed.
An advisory published on 9 September rates code injection in `adk web` at CVSS 10.0. It covers Google’s Agent Development Kit for Python from 2.0.0 through 2.6.0.
CVSS has no score above 10.0, and this one earns it on a precondition most people meet by accident rather than on anything exotic in the bug.
The mechanism is a denylist that did not list enough. `config_agent_utils` blocked a set of module references and the set was incomplete, which the record files as CWE-184, an incomplete list of disallowed inputs. An attacker reaches it through a crafted test session replay, and the replay path only executes where pytest is present in the environment. The advisory names Python running on open source, on Cloud Run and on GKE as affected environments.
That precondition is the whole story. A denylist gap on a code path nobody can reach is a bug. The same gap on a path reachable by anyone who shipped their development dependencies into the runtime image is unauthenticated remote code execution, which is why it scores at the top of the scale. Anyone who split dev and runtime requirements is already outside the blast radius and did not know that was a security decision when they made it.
Are you exposed right now? Only if you serve `adk web` on 2.0.0 through 2.6.0 with pytest in the image. Is it patched? Yes, in 2.7.0, by commit `a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d`.
The dates are the part worth pinning to a wall. ADK 2.7.0 was released on 13 August and 2.8.0 on 26 August, so the fix had been in the world for four weeks when the advisory landed on 9 September. Everyone who upgrades on a routine cadence was silently protected before being told there was anything to be protected from, and everyone who pins was exposed for that entire window with nothing to read.
There is a second reason not to wait for a tool to tell you. The GitHub Advisory Database still lists this record as unreviewed, which means its affected-range metadata has not been curated, and an uncurated range is not a reliable trigger for an automated alert. A separate CVE aggregator carries the same commit under a Medium header, against the Critical rating the CVE itself carries.
The verdict: upgrade to 2.7.0 or later, then do the thing the upgrade does not do and take pytest out of your production agent image. The precondition is the part you own, and it will still be there the next time a denylist turns out to be short.
What it changes Check your ADK version and your runtime image separately. Upgrading to 2.7.0 or later closes this specific denylist gap; removing pytest from the production image closes the class. Do not wait for a Dependabot alert, because the advisory is filed as unreviewed and may not produce one.
Primary source read