Threats tagged 'ghsa-jq64-vhh4-4hvv'

Agno versions up to 3.1.11 have an unsafe reflection vulnerability in the PandasTools component. This flaw allows attackers to invoke arbitrary pandas functions by supplying attacker-controlled function names to Python's getattr(). Exploitation can lead to arbitrary code execution by making the agent call pandas.read_pickle on attacker-controlled file paths or reading local files via other pandas readers.