Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
CVE-2026-35002
Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The fieldtype parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected. Patches Fixed in Agno 2.3.24. The unsafe eval() call was replaced with a fixed typemapping dictionary lookup, and fieldtype is now validated as either a known string key or an already-resolved type object before use. See commit [cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416) (PR #5912). All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix. Workarounds There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the fieldtype parameter of FunctionCall input fields,…
Part of the AI stack
This affects Agno, in Agent frameworks.
Assessment
- CVSS
- 9.8 (v3.1)
- Severity
- Critical
- EPSS
- 0.00842% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- pip · agno
- Weakness
- CWE-95
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98
- https://nvd.nist.gov/vuln/detail/CVE-2026-35002
- https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- https://github.com/agno-agi/agno/releases/tag/v2.3.24
- https://github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.yaml
- https://pypi.org/project/agno
- https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution
- https://github.com/advisories/GHSA-m4w4-3r8h-jw98
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-35002