Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.
// patchesFixed in Agno 2.3.24.
The unsafe eval() call was replaced with a fixed type_mapping dictionary lookup, and field_type is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.
// workaroundsThere is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred.
// referencesCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High