Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-35002: Agno allows attacker to run code via field_type
CVE-2026-35002 · published today
Summary
Versions of Agno before 2.3.24 let a specially crafted input run any Python code on the server. This could let an attacker read, change, or stop your data and services. Upgrade to version 2.3.24 or later to close the risk.
What to do
- Update agno team agno to version 2.3.24.
- Update agno to version 2.3.24.
- Update agno agno to version 2.3.24 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | agno team | agno |
< 2.3.24 Fix: upgrade to 2.3.24
|
| – | agno | agno |
< 2.3.24 cpe:2.3:a:agno:agno:*:*:*:*:*:*:*:* |
| pip | – | agno |
< 2.3.24 Fix: upgrade to 2.3.24
|
Original advisory text
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
### Impact
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The `field_type` parameter on a `FunctionCall`
input field was passed to Python's built-in `eval()`, allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality,
integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs
(for example via an API, web UI, or untrusted tool/model output) is affected.
### Patches
Fixed in **Agno 2.3.24**.
The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary
lookup, and `field_type` is now validated as either a known string key or an
already-resolved `type` object before use. See commit
[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)
(PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x)
includes the fix.
### Workarounds
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the `field_type` parameter of `FunctionCall`
input fields, but upgrading is strongly preferred.
### References
- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- Patch PR: https://github.com/agno-agi/agno/pull/5912
- CWE-95: https://cwe.mitre.org/data/definitions/95.html
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The `field_type` parameter on a `FunctionCall`
input field was passed to Python's built-in `eval()`, allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality,
integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs
(for example via an API, web UI, or untrusted tool/model output) is affected.
### Patches
Fixed in **Agno 2.3.24**.
The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary
lookup, and `field_type` is now validated as either a known string key or an
already-resolved `type` object before use. See commit
[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)
(PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x)
includes the fix.
### Workarounds
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the `field_type` parameter of `FunctionCall`
input fields, but upgrading is strongly preferred.
### References
- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- Patch PR: https://github.com/agno-agi/agno/pull/5912
- CWE-95: https://cwe.mitre.org/data/definitions/95.html
References
- https://github.com/agno-agi/agno Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35002... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-35002
- https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- https://github.com/agno-agi/agno/releases/tag/v2.3.24
- https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-co...
- https://github.com/advisories/GHSA-77rh-m34w-rv36
- https://github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.ya...
- https://pypi.org/project/agno
- https://github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98
- https://github.com/advisories/GHSA-m4w4-3r8h-jw98
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published27 Oct 2026
Updated28 Oct 2026
First seen2 Apr 2026
Sources
CVE-2026-35002 · OSV
CVE-2026-35002 · NVD
GHSA-77rh-m34w-rv36 · GHSA
GHSA-77rh-m34w-rv36 · OSV
CVE-2026-35002 · MITRE
GHSA-m4w4-3r8h-jw98 · GHSA
PYSEC-2026-256 · OSV
Track software like this
Free during beta