CVE-2026-35002 in Agno
Summary
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Responsible
VulnCheck
Reservation
03/31/2026
Disclosure
04/02/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354882 | Agno Parameter eval eval injection | 95 | Not defined | Official fix | CVE-2026-35002 |