CVE-2026-119050 in Agno
Summary
by MITRE • 10/29/2026
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The security flaw identified in Agno versions through 3.1.11 centers on an unsafe reflection mechanism within the PandasTools component of the application framework. This vulnerability stems from a fundamental design error where user-supplied input, specifically function names derived from model-generated prompts or agent decisions, is passed directly to Python's getattr() function without adequate validation or sanitization. In software development, reflection allows programs to inspect and modify their own structure at runtime, but when applied to external inputs in an uncontrolled manner, it creates a severe security risk known as arbitrary code execution via unsafe deserialization or method invocation. The core technical flaw lies in the lack of a whitelist approach for allowed functions; instead, the system trusts the model's output implicitly, allowing any attribute accessible on the pandas library object to be invoked by an attacker who can influence the prompt sent to the AI agent.
This vulnerability is particularly dangerous because it leverages the capabilities of large language models and autonomous agents to bridge the gap between natural language input and low-level system operations. An adversary does not need traditional network-based exploitation techniques such as buffer overflows or SQL injection. Instead, they can utilize prompt injection attacks to manipulate the AI agent into believing that a specific pandas function is required for data processing tasks. By crafting malicious prompts, an attacker can instruct the agent to invoke functions like pandas.read_pickle with arguments pointing to arbitrary file paths on the host system. Since pickle files in Python are capable of executing arbitrary code during deserialization, this leads directly to remote code execution (RCE) under the context of the user running the Agno application. This effectively bypasses standard input validation layers because the malicious payload is embedded within legitimate-looking data processing requests generated by the AI itself.
The operational impact of this vulnerability extends beyond simple file reading or arbitrary function calls, encompassing significant risks to system integrity and confidentiality. If an attacker successfully exploits the unsafe reflection in PandasTools, they can read sensitive local files such as configuration files, environment variables containing secrets, or private keys stored on disk by using other pandas readers like pandas.read_csv or pandas.read_json with controlled paths. Furthermore, the ability to execute arbitrary code means that attackers could install backdoors, exfiltrate data from memory, pivot to internal network resources, or escalate privileges depending on the permissions of the process running Agno. This represents a critical failure in security boundaries for AI applications, where the trust boundary between user input and system execution is dangerously blurred by the autonomous nature of agent-based architectures.
From a classification perspective, this vulnerability aligns with CWE-470, which describes unsafe reflection using externally-controlled inputs, and falls under the broader category of CWE-94, improper control of generation of code (code injection). In terms of adversary tactics, it maps to MITRE ATT&CK technique T1623.1, where attackers use machine learning models or agents to generate malicious payloads that bypass traditional security controls. The exploitation path also relates to CWE-502, deserialization of untrusted data, particularly when pickle files are involved in the code execution chain. These classifications highlight that the issue is not merely a coding error but a systemic architectural weakness common in early-generation AI agent frameworks that prioritize flexibility over strict input validation and sandboxing.
Mitigation strategies must focus on implementing strict allow-lists for function invocation within PandasTools rather than relying on implicit trust of model outputs. Developers should restrict the set of callable functions to only those strictly necessary for legitimate operations, ensuring that dangerous methods like read_pickle or any method capable of file system access are excluded unless explicitly and securely configured by an administrator with elevated privileges. Additionally, implementing a sandboxing environment using Python's built-in mechanisms such as restricted execution environments or external containers can limit the blast radius if exploitation occurs. Input validation should be applied at multiple layers, including sanitizing prompts before they reach the agent logic and validating all arguments passed to library functions against expected schemas and path constraints. Upgrading Agno to a version that patches this reflection vulnerability is essential for maintaining security posture in production environments relying on AI-driven data processing workflows.