Live › vulnerability › CVE-2026-35002
Go to dashboardAgno versions before 2.3.24 pass the field_type parameter of a FunctionCall input field to Python's built-in eval(). An attacker who can influence that value runs arbitrary Python code inside the Agno process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 13:31 UTC, 0h before NVD. All times on this page are UTC.
Deployments that expose Agno to user-influenced FunctionCall inputs are affected, for example through an API, a web UI, or untrusted tool or model output that reaches field_type. Teams that only run Agno on fully trusted internal inputs have a lower exposure, but the sources do not say how common that setup is.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| agno | pypi | < 2.3.24 | 2.3.24 |
| agno | vendor | < 2.3.24 | 2.3.24 |
pip show agno and check whether the version is below 2.3.24FunctionCall inputs and check whether any user-supplied value, API field, or model/tool output can reach field_typeagno package to 2.3.24 or later (the 2.6.x line includes the fix)field_typeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The field_type parameter on a FunctionCall
input field was passed to Python's built-in eval(), allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.
Fixed in Agno 2.3.24.
The unsafe eval() call was replaced with a fixed type_mapping dictionary
lookup, and field_type is now validated as either a known string key or an
already-resolved type object before use. See commit
cbf67552
(PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the field_type parameter of FunctionCall
input fields, but upgrading is strongly preferred.
This page as .md · .json · in your agent: get_signal("CVE-2026-35002")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.