pypi package report

Is google-adk safe?

1 known vulnerability, worst severity CRITICAL.

// reach

130 direct dependencies

35 carry known advisories, worst CRITICAL

24 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
9.3
critical

CVSS v4.0 base score out of 10

epss
1.8%
medium

chance of exploitation in 30 days, 79th percentile of all CVEs

xyz score
5.0
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-rg7c-g689-fr3x, the advisory selected below

// 1 advisories

GHSA-rg7c-g689-fr3x

CRITICALGitHub ratingCVE-2026-4810

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Python (OSS), Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance.

This vulnerability was patched in versions 1.28.1 and 2.0.0a2.

Customers need to redeploy the upgraded ADK to their production environments. In addition, if they are running ADK Web locally, they also need to upgrade their local instance.

// cvss v4.0 vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/U:Amber

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
High
Integrity (subsequent systems)
High
Availability (subsequent systems)
High
Exploit maturity
Proof of concept
U
Amber

Checked 2026-11-06 at 20:21 UTC. The most recent advisory here was published 2026-04-13. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.