In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, GitHub-reviewed advisory GHSA-m4w4-3r8h-jw98, "Agno: Arbitrary code execution via eval() on field_type in FunctionCall" (published October 27, 2026), checked .

CVE
CVE-2026-35002
Exploited?
No attacks reported. CISA's assessment on the CVE record lists exploitation as "none", and the flaw isn't in CISA's Known Exploited Vulnerabilities catalog at our check. The fix has been public since January 2026.

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
agno (Python package on PyPI)All versions before 2.3.242.3.24 and later (latest at our check: 3.1.10)Agno v2.3.24 release, checked

Patch checklist

  1. Run pip show agno in every environment that runs your agents (servers, containers, CI images) and note the Version line.
  2. If it's below 2.3.24, upgrade: pip install --upgrade agno, or pin agno>=2.3.24 in requirements.txt or pyproject.toml. The GitHub advisory says "All users should upgrade to 2.3.24 or later."
  3. Our advice: rebuild and redeploy container images, since an old image keeps the old package even after you change requirements.
  4. Our advice: check lock files (poetry.lock, uv.lock, requirements.txt pins) so a later install doesn't bring back an old version.

If you can't upgrade yet

  • The advisory offers no real workaround, only this interim step: "Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred."
  • Our advice: until you upgrade, don't expose agents that ask users for input fields to the public internet or to untrusted tool or model output.

How to check for compromise

  • Our advice: if an agent on a version before 2.3.24 was reachable by untrusted users or read untrusted tool output, rotate the API keys and credentials it could access and review its logs for unexpected commands or outbound connections.

Full steps and context: What to do now

TL;DR: Agno, an open-source Python framework for building AI agents, had a critical flaw, CVE-2026-35002, in versions before 2.3.24. A field that names a data type (field_type) on a FunctionCall input was passed to Python’s eval(), so anyone who could influence that value could run their own Python code inside your agent. NVD rates it 9.8 under CVSS 3.1; VulnCheck rates it 9.3 under CVSS 4.0. The fix shipped in Agno 2.3.24 on January 8, 2026; what’s new is GitHub’s reviewed advisory, published today, so scanners will start flagging old installs now. If pip show agno reports a version below 2.3.24, upgrade.

What happened

GitHub published reviewed advisory GHSA-m4w4-3r8h-jw98 on October 27, 2026. It says: “The field_type parameter on a FunctionCall input field was passed to Python’s built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.” It adds that “Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.”

The bug isn’t new. Agno replaced the eval() call with a fixed lookup table in release 2.3.24 on January 8, 2026; the release notes list it as “fix: replace eval() with type mapping”. The CVE was published on April 2, 2026, by VulnCheck, which credits Eran Shimony of Palo Alto Networks with finding it. NVD rates it 9.8 out of 10 under CVSS 3.1; VulnCheck rates it 9.3 under CVSS 4.0. What’s new today is GitHub’s reviewed advisory, which replaces an earlier duplicate and feeds the GitHub Dependabot alerts many teams rely on.

Our reading of the fix commit: the vulnerable code handled the input fields a tool can ask to have filled in before it runs, part of Agno’s human-in-the-loop features. CISA’s assessment on the CVE record lists exploitation as “none”, and we found no reports of attacks.

Why it matters

Agent frameworks pass text from users, websites and models straight into code. When any of that text reaches eval(), a crafted value becomes code running with your agent’s permissions, which often include API keys, database access and the ability to call other tools. If your Agno agent is reachable from a website or API, or reads output from tools you don’t control, treat this as serious.

The fix is more than nine months old, so most teams that update regularly are covered. The risk is in what doesn’t get updated: stale container images, pinned requirements files and forgotten prototypes that went live. It’s the same lesson as the critical flaws we covered in the OpenHands SDK and Google’s MCP Toolbox, OpenCode on Windows and the Codex AGENTS.md attack: agent tooling needs the same patching as any web app. Our Security hub tracks the rest.

What to do now

  1. Check your version. Run pip show agno in each environment that runs your agents, including inside containers (docker exec <container> pip show agno). Anything below 2.3.24 is affected.
  2. Upgrade. Run pip install --upgrade agno, or set agno>=2.3.24 in requirements.txt or pyproject.toml. Agno 2.3.24 is on PyPI; the latest version at our check was 3.1.10. Our advice: if you’re jumping from 2.x to 3.x, read Agno’s release notes and test first, or upgrade within the 2.x line if you need a smaller change.
  3. Rebuild and redeploy. Our advice: rebuild container images and redeploy, and update lock files so an old version doesn’t creep back in.
  4. If you can’t upgrade today. The advisory says “There is no safe workaround.” Its interim advice is to make sure no untrusted input can reach the field_type parameter. Our advice: take public-facing agents that use user input fields offline until they’re upgraded.
  5. Turn on dependency alerts. Our advice: enable Dependabot or a similar scanner on repos that use Agno, so the next advisory reaches you the day it’s published.

Updates

  • Oct 27, 2026, 10:17 p.m. Manila: First published. No reported exploitation at our check.

Sources & method

Sources

Method. Last checked October 27, 2026, at 10:17 p.m. Manila time (14:17 UTC). The description, affected and fixed versions, and the workaround quote come from GitHub’s reviewed advisory; the release date and fix note come from Agno’s v2.3.24 release on GitHub and PyPI; the CVSS scores, finder credit and CISA assessment come from NVD and the CVE record. The advisory’s text gives a CVSS 3.1 score of 9.3 while its own metadata and NVD give 9.8; we use NVD’s 9.8. The advisory also calls 2.6.x “the current release line”, but PyPI lists 3.1.10 as the latest. We checked CISA’s Known Exploited Vulnerabilities catalog. Steps labelled “our advice” and the docker exec tip are our own advice. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.