CVE-2025-64168: Agno session state overwrites between different sessions/users

The vulnerability is a race condition in the agno library that occurs when Agent or Team instances handle concurrent run or arun requests. The root cause was the use of shared instance variables (e.g., _tools_for_model, _functions_for_model) to store tool definitions that were dynamically generated for each execution. The session_state, which contains user-specific data, was being bound to these tools.

Under high concurrency, a race condition could occur: one execution thread could generate its tools and bind its session_state, but before it finished, another thread could overwrite the shared tool definitions with its own tools and session_state. This would cause the first thread to proceed with the second thread's session data, leading to information disclosure between users.

The patch, identified in commit e33e12e127431bfcfb0ef9f673745f8f369bdbf6, resolves this issue by refactoring the tool handling logic. Instead of storing tool definitions in instance variables, the code was changed to process them as local variables within the scope of each run or arun call. This ensures that each execution has its own isolated set of tools and that session_state cannot leak between concurrent requests. The vulnerable functions are the public run and arun methods of the Agent and Team classes, as they are the entry points for triggering this race condition.