Live › vulnerability › CVE-2026-119050
Agno, a Python framework for building AI agents, passes model-chosen function names into getattr() in its PandasTools, so an attacker can call any pandas function. Through prompt injection, an attacker can make the agent call pandas.read_pickle on a crafted file for code execution, or call other readers to read local files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Teams running Agno agents that include the PandasTools toolkit and that feed the model content an attacker can influence, such as web pages, emails or documents. Agents without PandasTools, or without untrusted input reaching the model, are less exposed. The sources do not say whether the flaw needs a particular configuration beyond enabling that toolkit.
No product ranges from the sources yet.
pip show agno and compare it to the fixed release.grep -r PandasTools).3.1.11).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
This page as .md · .json · in your agent: get_signal("CVE-2026-119050")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.