PT-2026-29747 · Agno · Agno

Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-35002

Mitre

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field type parameter passed to eval(). Attackers can influence the field type value in a FunctionCall to achieve remote code execution.

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-35002

Affected Products

Agno

References · 4

• https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35002 · Security Note
• https://github.com/agno-agi/agno/releases/tag/v2.3.24 · Note
• https://vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution · Note