CRITICAL 9.8 GitHub

CVE-2026-35002

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

### Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The `field_type` parameter on a `FunctionCall` input field was passed to Python's built-in `eval()`, allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes A

Affected Products

pip/agno < 2.3.24

References

Published: 2026-10-27 · Source: GitHub · Feed updated: 2026-10-27

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-10-27 via GitHub. Affected: pip/agno < 2.3.24.

Risk Timeline

CVE Disclosed2026-10-27 · -1 days ago

Remediation Resources

GitHub

github.com/advisories/GHSA-m4w4-3r8h-jw98

GitHub

github.com/agno-agi/agno/security/advisories/GHSA-m4w4-3r8h-jw98

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-35002

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2026-48705	MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydic	CRITICAL	9.3
CVE-2026-112398	Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execu	CRITICAL	—
CVE-2026-112393	Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO	CRITICAL	—
CVE-2026-112900	Pillow: Argument Injection in Ghostscript call, potentially leading into RCE	CRITICAL	—
CVE-2026-27975	Ajenti has potential Remote Code Execution	HIGH	9.8
CVE-2026-49272	OAuthLib: Bearer token can be retrieved as long as client knows a valid client I	HIGH	8.5

vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.