{"id":"CVE-2026-119050","kind":"vulnerability","aliases":["CVE-2026-119050"],"related":[],"title":"Agno: unsafe reflection in PandasTools lets prompt injection run code","description":"Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.","summary":"Agno, a Python framework for building AI agents, passes model-chosen function names into getattr() in its PandasTools, so an attacker can call any pandas function. Through prompt injection, an attacker can make the agent call pandas.read_pickle on a crafted file for code execution, or call other readers to read local files.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agno","ai-agents","ai-tooling","pandas","python"],"not_affected_if":["no-pandastools","no-untrusted-input"],"how_to_check":"- Check the installed Agno version with `pip show agno` and compare it to the fixed release.\n- Look for the PandasTools toolkit in agent configurations (`grep -r PandasTools`).\n- Confirm whether the agent processes untrusted input such as web pages, emails or uploaded documents.","fix":"- Agno: unknown (sources do not state a fixed version; the affected range is through `3.1.11`).","status":"open","published_at":"2026-10-29T14:17:51+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:25:52+00:00","updated_at":"2026-10-29T14:25:52+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-29T14:25:52Z","model":"claude-haiku-5-5","output":{"fix":"- Agno: unknown (sources do not state a fixed version; the affected range is through `3.1.11`).","reach":"internet","title":"Agno: unsafe reflection in PandasTools lets prompt injection run code","impact":"high","summary":"Agno, a Python framework for building AI agents, passes model-chosen function names into getattr() in its PandasTools, so an attacker can call any pandas function. Through prompt injection, an attacker can make the agent call pandas.read_pickle on a crafted file for code execution, or call other readers to read local files.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["agno","python","ai-agents","pandas"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server through prompt injection","analyst_note":"Confirm the first fixed Agno version and whether PandasTools is enabled by default; the NVD entry is the only source.","how_to_check":"- Check the installed Agno version with `pip show agno` and compare it to the fixed release.\n- Look for the PandasTools toolkit in agent configurations (`grep -r PandasTools`).\n- Confirm whether the agent processes untrusted input such as web pages, emails or uploaded documents.","plain_action":"","needs_analyst":true,"not_affected_if":["no-pandastools","no-untrusted-input"],"who_is_affected":"Teams running Agno agents that include the PandasTools toolkit and that feed the model content an attacker can influence, such as web pages, emails or documents. Agents without PandasTools, or without untrusted input reaching the model, are less exposed. The sources do not say whether the flaw needs a particular configuration beyond enabling that toolkit.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000735,"input_tokens":4151,"output_tokens":639,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119050':13A,16A '-2026':12A,15A '3.1.11':82C 'agent':20B,33B,61B,115C 'agno':1A,17B,26B,80C 'ai':19B,22B,32B 'ai-ag':18B 'ai-tool':21B 'allow':91C 'arbitrari':95C 'attack':47B,57B,92C,107C,121C 'attacker-control':120C 'build':31B 'call':49B,62B,73B,116C,128C 'chosen':37B 'code':10A,70B,125C 'contain':83C 'control':102C,122C 'craft':67B 'cve':11A,14A 'execut':71B,126C 'file':68B,79B,134C 'framework':29B 'function':38B,52B,97C,103C 'getattr':41B,106C 'inject':8A,55B,111C 'invok':94C 'let':6A 'local':78B,133C 'make':59B,113C 'model':36B,101C 'model-chosen':35B 'model-control':100C 'name':39B,104C 'panda':24B,51B,96C 'pandas.read':63B,117C 'pandastool':5A,44B,89C 'pass':34B 'path':123C 'pickl':64B,118C 'prompt':7A,54B,110C 'python':25B,28B 'read':77B,132C 'reader':75B,130C 'reflect':3A,86C 'run':9A 'suppli':99C 'tool':23B 'unsaf':2A,85C 'use':109C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Teams running Agno agents that include the PandasTools toolkit and that feed the model content an attacker can influence, such as web pages, emails or documents. Agents without PandasTools, or without untrusted input reaching the model, are less exposed. The sources do not say whether the flaw needs a particular configuration beyond enabling that toolkit.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119050","severity":null,"published_at":"2026-10-29T14:17:51+00:00","modified_at":"2026-10-29T14:17:52+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}