CVE-2026-35002 in Agno
摘要 (英语)
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
负责
VulnCheck
预定
2026-03-31
披露
2026-04-02
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354882 | Agno Parameter eval 远程代码执行 | 95 | 未定义 | 官方修复 | CVE-2026-35002 |