Threats affecting pkg:pypi/agno

Agno versions up to 3.1.11 contain an unsafe reflection vulnerability in the PandasTools component. This flaw allows attackers to supply model-controlled function names to Python's getattr(), enabling invocation of arbitrary pandas functions. Exploitation can involve prompt injection to execute code by calling pandas.read_pickle on attacker-controlled paths or reading local files via other pandas readers.

Agno versions prior to 2.3.24 contain a critical arbitrary code execution vulnerability due to unsafe use of Python's eval() on the field_type parameter in FunctionCall inputs. This flaw allows attackers who can influence field_type to execute arbitrary Python code within the Agno process, impacting confidentiality, integrity, and availability. The vulnerability is fixed in version 2.3.24 and later. No safe workaround exists other than upgrading or ensuring no untrusted input reaches the vulnerable parameter.

CVE-2026-108817 is an OS command injection vulnerability in the agno-agi agno software up to version 3.0.9. The flaw exists in the function agno.CodingTools.run_shell within the CodingTools component, allowing remote attackers to manipulate the command argument and execute arbitrary OS commands. The vulnerability has been publicly disclosed and can be exploited remotely. Upgrading to version 3.0.10 resolves the issue.