Advisoriesby IbisAgno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
Impact
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The field_type parameter on a FunctionCall
input field was passed to Python's built-in eval(), allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality,
integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs
(for example via an API, web UI, or untrusted tool/model output) is affected.
Patches
Fixed in Agno 2.3.24.
The unsafe eval() call was replaced with a fixed type_mapping dictionary
lookup, and field_type is now validated as either a known string key or an
already-resolved type object before use. See commit
[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)
(PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x)
includes the fix.
Workarounds
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the field_type parameter of FunctionCall
input fields, but upgrading is strongly preferred.
References
- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
-...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| agno PyPI | < 2.3.24 | 2.3.24 |
Details and references
### Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The `field_type` parameter on a `FunctionCall` input field was passed to Python's built-in `eval()`, allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected. ### Patches Fixed in **Agno 2.3.24**. The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary lookup, and `field_type` is now validated as either a known string key or an already-resolved `type` object before use. See commit [cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416) (PR #5912). All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix. ### Workarounds There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the `field_type` parameter of `FunctionCall` input fields, but upgrading is strongly preferred. ### References - Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416 - Patch PR: https://github.com/agno-agi/agno/pull/5912 - CWE-95: https://cwe.mitre.org/data/definitions/95.html
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-95
- Also known as
- CVE-2026-35002, GHSA-77rh-m34w-rv36, PYSEC-2026-256
- github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98
- nvd.nist.gov/vuln/detail/CVE-2026-35002
- github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- github.com/agno-agi/agno
- github.com/agno-agi/agno/releases/tag/v2.3.24
- github.com/pypa/advisory-database/tree/main/vulns/agno/PYSEC-2026-256.yaml
- pypi.org/project/agno
- www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution