Agno eval() code injection in FunctionCall field_type — arbitrary Python code execution (CVE-2026-35002)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-35002
Agno, a popular Python AI agent framework (1.8M monthly downloads, 42K GitHub stars), contained an arbitrary code execution flaw (CWE-95) in its model execution component: the fieldtype parameter on FunctionCall input fields was passed to Python's built-in eval(). An attacker able to influence that value — e.g. via an API, web UI, or untrusted tool/model output — could execute arbitrary Python code in the Agno process with full confidentiality, integrity and availability impact. All deployments exposing Agno to user-influenced FunctionCall inputs are affected. Fixed in Agno 2.3.24 (commit cbf67552, PR 5912), which replaced eval() with a fixed typemapping dictionary lookup and validates fieldtype as a known string key or resolved type object. No in-the-wild exploitation is reported; no safe workaround exists.
What to do
- Upgrade agno to 2.3.24 or later immediately (current 2.6.x line includes the fix)
- If upgrade is delayed, ensure no untrusted input can reach the field_type parameter of FunctionCall input fields
- Audit deployments that expose Agno via APIs, web UIs, or untrusted tool/model output for exposure
- Review logs for signs of exploitation of FunctionCall field_type values
Fixed versions
Sources
All live incidents on Threat Watch
