Read the docs
TI-2026-82408 Aliases CVE-2026-119050GHSA-jq64-vhh4-4hvv

Code execution in Agno via unsafe reflection in PandasTools

Priority HIGH 75CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Agno through 3.1.11 contains an unsafe reflection flaw in PandasTools (CWE-470) where model-controlled function names are passed to getattr(), letting attackers invoke arbitrary pandas functions. An unauthenticated remote attacker can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other pandas readers to read local files.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
agno-agiagnoup to 3.1.11—No fix listedCNA
  • agno Vendoragno-agi Affected up to 3.1.11 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Agno.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119050
  2. 2026-10-29 Alias added: GHSA-jq64-vhh4-4hvv
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → HIGH

References

Other 4

  • TI-2026-08858 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata() CVSS 4.0HIGH 8.7
  • TI-2026-70914 Improper control of dynamic code resources in agno-agi agno exec CVSS 4.0MEDIUM 6.9
  • TI-2026-70913 Missing authentication in agno-agi agno get_authentication_dependency CVSS 4.0MEDIUM 6.9
  • TI-2026-70915 Execution with unnecessary privileges in agno delegation feature CVSS 4.0MEDIUM 5.3
  • TI-2026-70908 Code injection in agno-agi agno PythonTools CVSS 4.0MEDIUM 5.3
  • TI-2025-07932 agno-agi agno Model Context Protocol mcp.py MultiMCPTools os command injection CVSS 4.0MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences