CVE-2026-35002

Agno field-type evaluation permits arbitrary Python execution

Agno · Agno model execution / FunctionCall

First documented disclosure · Review checkpoint

Summary

Attacker-influenced field types reach Python eval.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

FunctionCall field_type values are dynamically evaluated rather than resolved through an allowed type map.

Conditions required

Ability to influence a field_type value reaching the vulnerable model-execution path.

Potential impact

Python code execution with the application process privileges.

Affected versions and configurations

Agno before 2.3.24, according to VulnCheck.

Fix and mitigation status

2.3.24; patch replaces eval with dictionary lookup.

Practical next steps

Upgrade to a supported release containing the fix; validate schemas and prevent untrusted type names becoming executable code.

Operating lesson

Treat model metadata and tool schemas as data, never code.

Evidence and limits

Public PR 5912 opened January 6, merged January 7 and shipped January 8. April 2 is later CNA publication. The CNA also labels patch commit cbf6755 as affected despite tagging it as a patch; the maintainer diff and release establish the fix, so that contradictory hash is not used as an affected-version assertion.

Sources