Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

KRITISCH 9.8CVE-2026-35002 · GHSA-77rh-m34w-rv36 · GHSA-m4w4-3r8h-jw98 · Published 02/04/2026 · updated 08/10/2026

Package	Affected versions	Patched versions
agno PyPI	`< 2.3.24`	`2.3.24`
agno agno	`< 2.3.24`	`2.3.24`

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m4w4-3r8h-jw98. This link is maintained to preserve external references.

Original Description

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-35002 · ADVISORY
agno-agi/agno commit cbf6755 · WEB
agno-agi/agno · PACKAGE
agno-agi/agno release v2.3.24 · WEB
pypa/advisory-database · WEB
pypi.org/project/agno · WEB
vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution · WEB
agno-agi/agno security advisory · WEB
GitHub Advisory GHSA-77rh-m34w-rv36 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

agno

PyPI

< 2.3.24

2.3.24

agno

< 2.3.24

2.3.24

Description