Threats affecting pkg:pypi/Agno

CVE-2026-119050 is a critical unsafe reflection vulnerability in agno-agi's agno product up to version 3.1.11. It allows attackers to supply model-controlled function names to Python's getattr(), enabling invocation of arbitrary pandas functions. This can lead to code execution by calling pandas.read_pickle on attacker-controlled paths or reading local files via other pandas readers.

CVE-2026-108817 is an OS command injection vulnerability in the agno-agi agno software up to version 3.0.9. The flaw exists in the function agno.CodingTools.run_shell within the CodingTools component, allowing remote attackers to inject and execute arbitrary OS commands. The vulnerability has been publicly disclosed and exploit code is available. Upgrading to version 3.0.10 resolves the issue.

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.py to delete all rows, target specific rows, or extract information through error-based or blind SQL injection techniques.

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

A race condition vulnerability in agno versions 2.0.0 up to but not including 2.2.2 can cause session state data to be assigned to the wrong user session under high concurrency. This may lead to exposure of user data across sessions. The issue is fixed in version 2.2.2.