Every CVE Search/ Get API key

CVE-2026-35002

Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

9.3 CriticalFix available

CVE-2026-35002 is a critical vulnerability (CVSS 9.3) in Agno, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in agno 2.3.24.

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.86%Up 0.4 points since Apr 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
CVE-2026-35002
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-95
Updated
2026-11-02
EUVDEUVD-2026-18334 9.3

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
EUVD-2026-18334
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-77rh-m34w-rv36 9.3

Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m4w4-3r8h-jw98. This link is maintained to preserve external references.

Original Description

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
GHSA-77rh-m34w-rv36
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-95
Updated
2026-11-02
GitHub AdvisoriesGHSA-m4w4-3r8h-jw98 9.8

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Impact

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.

This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).

Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.

Patches

Fixed in Agno 2.3.24.

The unsafe eval() call was replaced with a fixed type_mapping dictionary lookup, and field_type is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).

All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.

Workarounds

There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred.

References

Record
GHSA-m4w4-3r8h-jw98
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
NVD 9.3

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
CVE-2026-35002
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
OSV 9.3

Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
CVE-2026-35002
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-95
Updated
2026-11-02
OSVGHSA-77rh-m34w-rv36 9.3

Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m4w4-3r8h-jw98. This link is maintained to preserve external references.

Original Description

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
GHSA-77rh-m34w-rv36
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-95
Updated
2026-11-02
OSVGHSA-m4w4-3r8h-jw98 9.8

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Impact

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.

This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).

Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.

Patches

Fixed in Agno 2.3.24.

The unsafe eval() call was replaced with a fixed type_mapping dictionary lookup, and field_type is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).

All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.

Workarounds

There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred.

References

Record
GHSA-m4w4-3r8h-jw98
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-95
Updated
2026-11-02
OSVPYSEC-2026-256 9.3

Agno is vulnerable to Eval Injection

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Record
PYSEC-2026-256
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
agno
PyPI
 before 2.3.24
2.3.24
agno
PyPI
 before 2.3.24, plus listed versions
0.0.10.0.20.0.30.0.40.0.5
Show 45 moreShow less
0.0.60.0.70.1.00.1.10.1.20.1.30.1.40.1.50.1.60.1.71.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.81.1.01.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.16
2.3.24

History

History
WhenChangedSources
2026-11-03affected
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 119 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open