Security advisory for GHSA-m4w4-3r8h-jw98
GHSA-m4w4-3r8h-jw98
Full advisory details, affected packages, severity context, and original source.
Affected technology
Advisory overview
### Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The `field_type` parameter on a `FunctionCall` input field was passed to Python's built-in `eval()`, allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected. ### Patches Fixed in **Agno 2.3.24**. The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary lookup, and `field_type` is now validated as either a known string key or an already-resolved `type` object before use. See commit [cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416) (PR #5912). All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix. ### Workarounds There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the `field_type` parameter of `FunctionCall` input fields, but upgrading is strongly preferred. ### References - Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416 - Patch PR: https://github.com/agno-agi/agno/pull/5912 - CWE-95: https://cwe.mitre.org/data/definitions/95.html
Affected packages and releases
PyPI / agno
0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.1.0
Also known as
CVE-2026-35002 · GHSA-77rh-m34w-rv36 · PYSEC-2026-256