{"id":"CVE-2026-35002","kind":"vulnerability","aliases":["CVE-2026-35002","GHSA-m4w4-3r8h-jw98"],"related":[],"title":"Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`","description":"### Impact\nAgno versions prior to 2.3.24 contain an arbitrary code execution vulnerability\nin the model execution component. The `field_type` parameter on a `FunctionCall`\ninput field was passed to Python's built-in `eval()`, allowing an attacker who\ncould influence that value to execute arbitrary Python code in the Agno process.\n\nThis is a code injection flaw (CWE-95) with full impact to confidentiality,\nintegrity, and availability. CVSS 3.1 score: 9.3 (Critical).\n\nAny deployment that exposes Agno to user-influenced FunctionCall inputs\n(for example via an API, web UI, or untrusted tool/model output) is affected.\n\n### Patches\nFixed in **Agno 2.3.24**.\n\nThe unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary\nlookup, and `field_type` is now validated as either a known string key or an\nalready-resolved `type` object before use. See commit\n[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)\n(PR #5912).\n\nAll users should upgrade to 2.3.24 or later. The current release line (2.6.x)\nincludes the fix.\n\n### Workarounds\nThere is no safe workaround. Users who cannot upgrade should ensure no\nuntrusted input can reach the `field_type` parameter of `FunctionCall`\ninput fields, but upgrading is strongly preferred.\n\n### References\n- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416\n- Patch PR: https://github.com/agno-agi/agno/pull/5912\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html","summary":"Agno versions before 2.3.24 pass the field_type parameter of a FunctionCall input field to Python's built-in eval(). An attacker who can influence that value runs arbitrary Python code inside the Agno process.","severity":"critical","cvss":9.8,"epss":0.00842,"exploited":false,"exploited_at":null,"products":[{"name":"agno","fixed":["2.3.24"],"affected":"< 2.3.24","ecosystem":"pypi"},{"name":"agno","fixed":["2.3.24"],"affected":"< 2.3.24","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["agno","ai-agents","ai-tooling","cwe-95","python","self-hosted"],"not_affected_if":["no-untrusted-function-call-input","version-2.3.24-or-later"],"how_to_check":"- Run `pip show agno` and check whether the version is below `2.3.24`\n- Search your code and configuration for `FunctionCall` inputs and check whether any user-supplied value, API field, or model/tool output can reach `field_type`","fix":"- Upgrade the `agno` package to `2.3.24` or later (the 2.6.x line includes the fix)\n- The sources say there is no safe workaround; if you cannot upgrade, keep untrusted input away from `field_type`","status":"open","published_at":"2026-04-02T15:16:52+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","triaged_at":"2026-10-27T13:32:28+00:00","updated_at":"2026-10-27T13:32:28+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T13:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `agno` package to `2.3.24` or later (the 2.6.x line includes the fix)\n- The sources say there is no safe workaround; if you cannot upgrade, keep untrusted input away from `field_type`","reach":"internet","title":"Agno: eval() on FunctionCall field_type lets input run Python code","impact":"high","summary":"Agno versions before 2.3.24 pass the field_type parameter of a FunctionCall input field to Python's built-in eval(). An attacker who can influence that value runs arbitrary Python code inside the Agno process.","category":"ai-tooling","nicknames":[],"who_cares":["python","agno","ai-agents","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary Python code in the Agno process","analyst_note":"Sources do not say which API or UI paths expose FunctionCall field_type or whether authentication gates them; check the patch commit https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416 and PR https://github.com/agno-agi/agno/pull/5912 for the affected entry points.","how_to_check":"- Run `pip show agno` and check whether the version is below `2.3.24`\n- Search your code and configuration for `FunctionCall` inputs and check whether any user-supplied value, API field, or model/tool output can reach `field_type`","needs_analyst":true,"not_affected_if":["version-2.3.24-or-later","no-untrusted-function-call-input"],"who_is_affected":"Deployments that expose Agno to user-influenced FunctionCall inputs are affected, for example through an API, a web UI, or untrusted tool or model output that reaches field_type. Teams that only run Agno on fully trusted internal inputs have a lower exposure, but the sources do not say how common that setup is.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000737,"input_tokens":3929,"output_tokens":688,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-35002':14A,22A '-95':33B,133C,277C '/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416':270C '/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)':215C '/agno-agi/agno/pull/5912':275C '/data/definitions/95.html':280C '2.3.24':41B,79C,175C,223C '2.6':230C '3.1':143C '3r8h':18A '5912':217C '9.3':145C 'affect':170C 'agent':28B 'agno':1A,23A,24A,25B,38B,72B,75C,124C,151C,174C 'ai':27B,30B 'ai-ag':26B 'ai-tool':29B 'allow':109C 'alreadi':204C 'already-resolv':203C 'api':162C 'arbitrari':2A,67B,82C,119C 'attack':60B,111C 'avail':141C 'built':56B,106C 'built-in':55B,105C 'call':179C 'cannot':243C 'cbf67552':212C 'code':3A,69B,83C,121C,129C 'commit':211C,267C 'compon':90C 'confidenti':138C 'contain':80C 'could':113C 'critic':146C 'current':227C 'cve':12A,20A 'cvss':142C 'cwe':32B,132C,276C 'cwe.mitre.org':279C 'cwe.mitre.org/data/definitions/95.html':278C 'deploy':148C 'dictionari':187C 'either':196C 'ensur':246C 'eval':6A,58B,108C,178C 'exampl':159C 'execut':4A,84C,89C,118C 'expos':150C 'field':8A,44B,51B,92C,99C,190C,253C,259C 'fix':172C,184C,234C 'flaw':131C 'full':135C 'functioncal':11A,49B,97C,156C,257C 'ghsa':16A 'ghsa-m4w4-3r8h-jw98':15A 'github.com':214C,269C,274C 'github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416':268C 'github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)':213C 'github.com/agno-agi/agno/pull/5912':273C 'host':37B 'impact':74C,136C 'includ':232C 'influenc':63B,114C,155C 'inject':130C 'input':50B,98C,157C,249C,258C 'insid':70B 'integr':139C 'jw98':19A 'key':200C 'known':198C 'later':225C 'line':229C 'lookup':188C 'm4w4':17A 'map':186C 'model':88C 'object':207C 'output':168C 'paramet':46B,94C,255C 'pass':42B,101C 'patch':171C,266C,271C 'pr':216C,272C 'prefer':264C 'prior':77C 'process':73B,125C 'python':34B,53B,68B,103C,120C 'reach':251C 'refer':265C 'releas':228C 'replac':181C 'resolv':205C 'run':66B 'safe':239C 'score':144C 'see':210C 'self':36B 'self-host':35B 'string':199C 'strong':263C 'tool':31B 'tool/model':167C 'type':9A,45B,93C,185C,191C,206C,254C 'ui':164C 'unsaf':177C 'untrust':166C,248C 'upgrad':221C,244C,261C 'use':209C 'user':154C,219C,241C 'user-influenc':153C 'valid':194C 'valu':65B,116C 'version':39B,76C 'via':5A,160C 'vulner':85C 'web':163C 'workaround':235C,240C 'x':231C","nicknames":[],"mitigations":[],"who_affected":"Deployments that expose Agno to user-influenced FunctionCall inputs are affected, for example through an API, a web UI, or untrusted tool or model output that reaches field_type. Teams that only run Agno on fully trusted internal inputs have a lower exposure, but the sources do not say how common that setup is.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-02T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-m4w4-3r8h-jw98","url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","severity":"critical","published_at":"2026-10-27T13:30:41+00:00","modified_at":"2026-10-27T13:30:42+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-35002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35002","severity":null,"published_at":"2026-04-02T15:16:52+00:00","modified_at":"2026-10-08T16:17:14+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}