Zero Radar
← feed
CriticalVulnerabilityCVE-2026-35002updated 27 Oct 2026, 13:31 UTC

Agno AI framework lets crafted input run arbitrary Python code

A flaw in the Agno AI library lets someone who can control part of its input run their own Python code on the server running it. That can mean stolen data, changed files, or a system that stops working.

Fix availableOfficial source
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesAgno 2.3.24 or later (the 2.6.x release line includes the fix) · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Crafted inputAttacker sets the field_type value
  2. 2Agno processes inputValue reaches FunctionCall handling
  3. 3eval() runs itBuilt-in eval executes the injected code
  4. 4Code runs on serverRuns inside the Agno process
  5. ResultAttacker runs code on the server

What happened

The FunctionCall input field's field_type parameter was passed to Python's built-in eval(), enabling code injection (CWE-95) in versions before 2.3.24.

Why it is dangerous: An attacker could gain full control of the Agno process, reading secrets and data or disrupting service. Anyone exposing Agno to user-influenced inputs such as APIs, web UIs, or untrusted model or tool output is at risk.

Are you affected?

You are affected if you run the pip package agno older than 2.3.24 and expose it to user-influenced FunctionCall inputs, such as through an API, web UI, or untrusted tool or model output.

Package / productAffected versionsFixed in
agno · pip< 2.3.242.3.24

What to do

  1. Upgrade the agno package to 2.3.24 or later (2.6.x recommended)
  2. If you cannot upgrade yet, block untrusted input from reaching the field_type parameter of FunctionCall inputs
  3. Review logs for unexpected FunctionCall inputs or unusual activity in the Agno process

Timeline

  1. 27 Oct 2026, 13:30 UTC
    Publicly disclosed
  2. 27 Oct 2026, 13:30 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 13:31 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-35002 · GHSA-m4w4-3r8h-jw98
CVSS
9.8 / 10
EPSS
0.9% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 13:30 UTC
On Zero Radar
27 Oct 2026, 13:31 UTC (1 min after disclosure)
Last change
27 Oct 2026, 13:31 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Agno AI framework lets crafted input run arbitrary Python code · Zero Radar