{"id":"GHSA-77rh-m34w-rv36","kind":"vulnerability","aliases":["GHSA-77rh-m34w-rv36"],"related":[],"title":"Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m4w4-3r8h-jw98. This link is maintained to preserve external references.\n\n### Original Description\nAgno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.","summary":"Agno versions before 2.3.24 pass the field_type value in a FunctionCall to eval(), so attacker-controlled input is executed as Python. An attacker who can influence that field can run arbitrary code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"agno","fixed":["2.3.24"],"affected":"< 2.3.24","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["agno","ai-agents","ai-tooling","cwe-95","python"],"not_affected_if":["version-2.3.24-or-later"],"how_to_check":"- Check the installed Agno version with `pip show agno` and compare it to `2.3.24`.\n- unknown","fix":"- Upgrade the Agno Python package to `2.3.24` or later.","status":"withdrawn","published_at":"2026-04-02T15:31:43+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","triaged_at":"2026-10-27T13:32:30+00:00","updated_at":"2026-10-27T13:32:30+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T13:32:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Agno Python package to `2.3.24` or later.","reach":"unknown","title":"Agno: eval() on field_type lets an attacker run Python code","impact":"high","summary":"Agno versions before 2.3.24 pass the field_type value in a FunctionCall to eval(), so attacker-controlled input is executed as Python. An attacker who can influence that field can run arbitrary code on the server.","category":"ai-tooling","nicknames":[],"who_cares":["python","agno","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary Python code on the server.","analyst_note":"Advisory is withdrawn as a duplicate; confirm details and any trigger conditions in GHSA-m4w4-3r8h-jw98 before relying on this entry.","how_to_check":"- Check the installed Agno version with `pip show agno` and compare it to `2.3.24`.\n- unknown","needs_analyst":true,"not_affected_if":["version-2.3.24-or-later"],"who_is_affected":"Teams running Agno versions before 2.3.24 where model output or other untrusted input can reach FunctionCall field_type values. This advisory is withdrawn as a duplicate of GHSA-m4w4-3r8h-jw98, so check that entry for the authoritative details. Systems pinned to 2.3.24 or later are not affected by this flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00061,"input_tokens":3433,"output_tokens":534,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-95':33B '2.3.24':38B,104C '3r8h':88C '77rh':16A,21A 'achiev':144C 'advisori':2A,73C,75C 'agent':28B 'agno':3A,24A,25B,35B,100C 'ai':27B,30B 'ai-ag':26B 'ai-tool':29B 'allow':117C 'arbitrari':4A,67B,107C,121C 'attack':51B,59B,118C,133C 'attacker-control':50B 'code':5A,68B,108C,123C,146C 'compon':115C 'contain':105C 'control':52B 'cwe':32B 'descript':99C 'duplic':1A,72C,83C 'eval':8A,48B,132C 'execut':6A,55B,109C,114C,120C,147C 'extern':96C 'field':10A,41B,64B,127C,137C 'functioncal':13A,46B,142C 'ghsa':15A,20A,86C 'ghsa-77rh-m34w-rv36':14A,19A 'ghsa-m4w4-3r8h-jw98':85C 'influenc':62B,135C 'input':53B 'jw98':89C 'link':91C 'm34w':17A,22A 'm4w4':87C 'maintain':93C 'manipul':125C 'model':113C 'origin':98C 'paramet':129C 'pass':39B,130C 'preserv':95C 'prior':102C 'python':34B,57B,122C 'refer':97C 'remot':145C 'run':66B 'rv36':18A,23A 'server':71B 'tool':31B 'type':11A,42B,128C,138C 'valu':43B,139C 'version':36B,101C 'via':7A 'vulner':110C 'withdrawn':78C","nicknames":[],"mitigations":[],"who_affected":"Teams running Agno versions before 2.3.24 where model output or other untrusted input can reach FunctionCall field_type values. This advisory is withdrawn as a duplicate of GHSA-m4w4-3r8h-jw98, so check that entry for the authoritative details. Systems pinned to 2.3.24 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-02T15:31:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-77rh-m34w-rv36","url":"https://github.com/advisories/GHSA-77rh-m34w-rv36","severity":"critical","published_at":"2026-04-02T15:31:43+00:00","modified_at":"2026-10-27T13:30:37+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","fetched_at":"2026-10-27T13:31:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}