CVE-2026-35002: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The field_type parameter on a FunctionCall
input field was passed to Python’s built-in eval(), allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.
References
- github.com/advisories/GHSA-m4w4-3r8h-jw98
- github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- github.com/agno-agi/agno/releases/tag/v2.3.24
- github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98
- github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-35002
- pypi.org/project/agno
- www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution
Code Behaviors & Features
Detect and mitigate CVE-2026-35002 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →