CVE-2026-35002 with a CVSS score of 9.8 is a critical code injection vulnerability in the Agno model execution component, affecting Agno versions prior to 2.3.24. The flaw occurs when the field_type parameter on a FunctionCall input field is passed to Python's built-in eval() function. An attacker who can influence that value, for example through user-supplied data, an API, a web interface, or untrusted tool or model output, can cause arbitrary Python code to execute inside the Agno process. The vulnerability is exploitable over the network with low complexity and does not require authentication, privileges, or user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system, allowing an attacker to read sensitive data, alter application behavior, disrupt services, or establish a foothold for further compromise. Because the affected component processes FunctionCall inputs, any deployment that exposes Agno to untrusted input is at risk. The impact is severe because arbitrary code execution can lead to full control of the vulnerable process and potentially broader business impact, including data leakage, unauthorized operations, and loss of trust in the application.
We recommend you to update Agno to version 2.3.24.[/subscribe_to_unlock_form]
CVE-2026-35002 with a CVSS score of 9.8 is a critical code injection vulnerability in the Agno model execution component, affecting Agno versions prior to 2.3.24. The flaw occurs when the field_type parameter on a FunctionCall input field is passed to Python's built-in eval() function. An attacker who can influence that value, for example through user-supplied data, an API, a web interface, or untrusted tool or model output, can cause arbitrary Python code to execute inside the Agno process. The vulnerability is exploitable over the network with low complexity and does not require authentication, privileges, or user interaction. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system, allowing an attacker to read sensitive data, alter application behavior, disrupt services, or establish a foothold for further compromise. Because the affected component processes FunctionCall inputs, any deployment that exposes Agno to untrusted input is at risk. The impact is severe because arbitrary code execution can lead to full control of the vulnerable process and potentially broader business impact, including data leakage, unauthorized operations, and loss of trust in the application.
We recommend you to update Agno to version 2.3.24.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]