CVE-2026-35002GHSA-77rh-m34w-rv36GHSA-m4w4-3r8h-jw98PYSEC-2026-256

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Agno agnopipLibraries & packages

CVSS

9.8Critical

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.84%Chance of exploitation activity in the next 30 days, higher than 57% of CVEs. Scored 27 Oct 2026FIRST EPSS

Fixed in2.3.24Fixed versionGitHub

Published2 Apr 2026Updated 27 Oct 2026CVE List

What fixes it

2.3.24agno, pipGitHub
2.3.24AgnoCVE List
2.3.24agno, PyPIOSVpip install "agno>=2.3.24"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@stackflag.bsky.social: CVE-2026-35002 - agno Versions of Agno before 2.3.24 let a specially crafted input control a function that runs arbitrary code, so an attacker could take over the application. ThisBluesky: CVE posts, 27 Oct 2026

Description

Impact

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.

This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).

Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.

Patches

Fixed in Agno 2.3.24.

The unsafe eval() call was replaced with a fixed type_mapping dictionary lookup, and field_type is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).

All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.

Workarounds

There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred.

References

Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
Patch PR: https://github.com/agno-agi/agno/pull/5912
CWE-95: https://cwe.mitre.org/data/definitions/95.html

Text from GitHub Advisory Database

Affected versions 54

agno, pip< 2.3.24GitHub
Agnoaffected: all versions before 2.3.24CVE List
Agnoaffected: cbf675521d4d2281925a051784a3b94172e56416CVE List
agno, PyPIfrom first release, fixed in 2.3.24OSV
agno, PyPI0.0.1OSV
agno, PyPI0.0.2OSV
agno, PyPI0.0.3OSV
agno, PyPI0.0.4OSV
agno, PyPI0.0.5OSV
agno, PyPI0.0.6OSV
agno, PyPI0.0.7OSV
agno, PyPI0.1.0OSV
agno, PyPI0.1.1OSV
agno, PyPI0.1.2OSV
agno, PyPI0.1.3OSV
agno, PyPI0.1.4OSV
agno, PyPI0.1.5OSV
agno, PyPI0.1.6OSV
agno, PyPI0.1.7OSV
agno, PyPI1.0.0OSV
agno, PyPI1.0.1OSV
agno, PyPI1.0.2OSV
agno, PyPI1.0.3OSV
agno, PyPI1.0.4OSV
agno, PyPI1.0.5OSV
agno, PyPI1.0.6OSV
agno, PyPI1.0.8OSV
agno, PyPI1.1.0OSV
agno, PyPI1.1.1OSV
agno, PyPI1.1.10OSV
agno, PyPI1.1.11OSV
agno, PyPI1.1.12OSV
agno, PyPI1.1.13OSV
agno, PyPI1.1.14OSV
agno, PyPI1.1.15OSV
agno, PyPI1.1.16OSV
agno, PyPI1.1.17OSV
agno, PyPI1.1.2OSV
agno, PyPI1.1.3OSV
agno, PyPI1.1.4OSV
agno, PyPI1.1.5OSV
agno, PyPI1.1.6OSV
agno, PyPI1.1.7OSV
agno, PyPI1.1.8OSV
agno, PyPI1.1.9OSV
agno, PyPI1.2.0OSV
agno, PyPI1.2.1OSV
agno, PyPI1.2.10OSV
agno, PyPI1.2.11OSV
agno, PyPI1.2.12OSV
agno, PyPI1.2.13OSV
agno, PyPI1.2.14OSV
agno, PyPI1.2.15OSV
agno, PyPI1.2.16OSV