---
id: "CVE-2026-35002"
kind: "vulnerability"
aliases: ["CVE-2026-35002", "GHSA-m4w4-3r8h-jw98"]
title: "Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`"
severity: "critical"
cvss: 9.8
epss: 0.00842
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agno", "fixed": ["2.3.24"], "affected": "< 2.3.24", "ecosystem": "pypi"}, {"name": "agno", "fixed": ["2.3.24"], "affected": "< 2.3.24", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["agno", "ai-agents", "ai-tooling", "cwe-95", "python", "self-hosted"]
not_affected_if: ["no-untrusted-function-call-input", "version-2.3.24-or-later"]
published_at: "2026-04-02T15:16:52+00:00"
first_seen_at: "2026-10-27T13:31:05+00:00"
updated_at: "2026-10-27T13:32:28+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-m4w4-3r8h-jw98", "first_seen_at": "2026-10-27T13:31:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35002", "first_seen_at": "2026-10-27T13:31:51+00:00"}]
---

# Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Agno versions before 2.3.24 pass the field_type parameter of a FunctionCall input field to Python's built-in eval(). An attacker who can influence that value runs arbitrary Python code inside the Agno process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:agno affected < 2.3.24 fixed 2.3.24
- vendor:agno affected < 2.3.24 fixed 2.3.24

## How to check

- Run `pip show agno` and check whether the version is below `2.3.24`
- Search your code and configuration for `FunctionCall` inputs and check whether any user-supplied value, API field, or model/tool output can reach `field_type`

## Fix

- Upgrade the `agno` package to `2.3.24` or later (the 2.6.x line includes the fix)
- The sources say there is no safe workaround; if you cannot upgrade, keep untrusted input away from `field_type`

## Timeline

- 2026-10-27T13:31:05+00:00 ghsa https://github.com/advisories/GHSA-m4w4-3r8h-jw98
- 2026-10-27T13:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-35002

## From the sources

### Impact
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The `field_type` parameter on a `FunctionCall`
input field was passed to Python's built-in `eval()`, allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.

This is a code injection flaw (CWE-95) with full impact to confidentiality,
integrity, and availability. CVSS 3.1 score: 9.3 (Critical).

Any deployment that exposes Agno to user-influenced FunctionCall inputs
(for example via an API, web UI, or untrusted tool/model output) is affected.

### Patches
Fixed in **Agno 2.3.24**.

The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary
lookup, and `field_type` is now validated as either a known string key or an
already-resolved `type` object before use. See commit
[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)
(PR #5912).

All users should upgrade to 2.3.24 or later. The current release line (2.6.x)
includes the fix.

### Workarounds
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the `field_type` parameter of `FunctionCall`
input fields, but upgrading is strongly preferred.

### References
- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- Patch PR: https://github.com/agno-agi/agno/pull/5912
- CWE-95: https://cwe.mitre.org/data/definitions/95.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_