cyfenced.com →

[ CVE-2026-35002 · Published 2 Apr 2026 ]

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

CVSS 9.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.3

[ Description ]Official description

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

[ Fixes ]Fixes and patches

  • agno 2.3.24Fixed version · GitHub Advisories · pip package agno: upgrade to 2.3.24 or later (affected < 2.3.24)

[ Packages ]Affected open-source packages

[ References ]References