{"schema":"threatline.record/2","record":{"id":"CVE-2026-35002","aliases":["GHSA-77rh-m34w-rv36","GHSA-m4w4-3r8h-jw98","PYSEC-2026-256"],"summary":"Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`","details":"### Impact\nAgno versions prior to 2.3.24 contain an arbitrary code execution vulnerability\nin the model execution component. The `field_type` parameter on a `FunctionCall`\ninput field was passed to Python's built-in `eval()`, allowing an attacker who\ncould influence that value to execute arbitrary Python code in the Agno process.\n\nThis is a code injection flaw (CWE-95) with full impact to confidentiality,\nintegrity, and availability. CVSS 3.1 score: 9.3 (Critical).\n\nAny deployment that exposes Agno to user-influenced FunctionCall inputs\n(for example via an API, web UI, or untrusted tool/model output) is affected.\n\n### Patches\nFixed in **Agno 2.3.24**.\n\nThe unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary\nlookup, and `field_type` is now validated as either a known string key or an\nalready-resolved `type` object before use. See commit\n[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)\n(PR #5912).\n\nAll users should upgrade to 2.3.24 or later. The current release line (2.6.x)\nincludes the fix.\n\n### Workarounds\nThere is no safe workaround. Users who cannot upgrade should ensure no\nuntrusted input can reach the `field_type` parameter of `FunctionCall`\ninput fields, but upgrading is strongly preferred.\n\n### References\n- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416\n- Patch PR: https://github.com/agno-agi/agno/pull/5912\n- CWE-95: https://cwe.mitre.org/data/definitions/95.html","categories":["Libraries & packages"],"product":"agno","vendor":"Agno","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","source_modified_at":"2026-10-27T13:30:42Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"agno"},"range":"< 2.3.24"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-35002","source_modified_at":"2026-10-08T15:22:31.629Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Agno","vendor":"Agno","versions":[{"status":"affected","version":"0","lessThan":"2.3.24","versionType":"semver"},{"status":"affected","version":"cbf675521d4d2281925a051784a3b94172e56416","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m4w4-3r8h-jw98","source_modified_at":"2026-10-27T13:55:51.996885256Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"agno","ecosystem":"PyPI","purl":"pkg:pypi/agno"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.24"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.8","1.1.0","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.16","1.1.17","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.14","1.2.15","1.2.16"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","source_modified_at":"2026-10-27T13:30:42Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"agno"},"version":"2.3.24"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-35002","source_modified_at":"2026-10-08T15:22:31.629Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Agno","ecosystem":null},"version":"2.3.24","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m4w4-3r8h-jw98","source_modified_at":"2026-10-27T13:55:51.996885256Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"agno","ecosystem":"PyPI","purl":"pkg:pypi/agno"},"version":"2.3.24"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00842,"percentile":0.57707,"score_date":"2026-10-27"},"published_at":"2026-04-02T14:34:14.538Z","modified_at":"2026-10-27T13:55:51.996885256Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:30:42Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-35002","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-08T15:22:31.629Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m4w4-3r8h-jw98","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:55:51.996885256Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35002","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98","source":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35002","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416","tags":["patch"]},{"source":"CVE List","url":"https://github.com/agno-agi/agno/releases/tag/v2.3.24","tags":["release-notes"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/agno","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-04-02T15:23:11.274152Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T13:55:51.996885256Z","content_hash":"77bc97fe5d1e25993eb1571ea53ce95e38a00cf39e465ed628d124d035f69448"}}