CVE-2026-119050

Agno PandasTools exposes unsafe pandas functions to model-controlled arguments

Agno · Agno PandasTools

First documented disclosure · Review checkpoint

Summary

Prompt-influenced tool arguments can select an unsafe deserializer or local-file reader.

Severity and exploitation evidence

Critical · 9.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher reports a local-only reproduction with fake data and offers the exploit privately. The public issue explains the mechanism but does not establish malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unrestricted getattr dispatch chooses pandas functions from model-controlled names. read_pickle can execute serialized code before the later DataFrame type check.

Conditions required

An agent is configured with PandasTools and an attacker influences tool arguments directly or through content the model processes. A pickle payload must be reachable as a local path or URL.

Potential impact

Code execution under the agent's permissions and potential local-file disclosure.

Affected versions and configurations

Through 3.1.11 per CNA; the original report tested 2.6.20 and the then-current main branch.

Fix and mitigation status

No fixed release is established in the reviewed sources; the original issue remains open.

Practical next steps

Remove PandasTools from untrusted workflows until patched, allowlist permitted constructors and operations, and isolate agents from sensitive files and credentials.

Operating lesson

A model-selected method name is an executable capability and needs an allowlist.

Evidence and limits

The original public issue dates July 2; the CNA was published October 29. This is separate from Agno's field_type/eval vulnerability. The reporter's critical label and VulnCheck's 9.2 CVSS 4.0 are attributed assessments, not evidence of an attack.

Sources