Executive brief
Agno, an AI agent framework, contains a critical security flaw in how it processes model instructions. An attacker can exploit this to run unauthorized Python code on the server or system hosting the AI agent. This could lead to a complete system takeover, theft of sensitive data, or disruption of AI-driven business operations.
Technical details
An eval injection vulnerability (CWE-95) exists in Agno's model execution component due to the unsafe use of the Python eval() function. The vulnerability is located in the handling of the field_type parameter within a FunctionCall. A remote, unauthenticated attacker can influence this parameter to execute arbitrary Python code in the context of the application. The issue was addressed in version 2.3.24 by replacing the dynamic eval() call with a secure dictionary-based type mapping.
Affected products
- Agno Agno prior to 2.3.24
Timeline
- 2026-01-08: patched: Version 2.3.24 released
- 2026-04-02: advisory: Initial disclosure by VulnCheck and NVD