Vulnerability details

CVE-2026-119050

agno-agi agno

Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

CVSS 4.0

9.2Critical

Official description

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
agno-agi	agno	v ≤ 3.1.11	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/agno-agi/agno product
https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54 technical-description
https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90 technical-description
https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection third-party-advisory
https://github.com/agno-agi/agno/issues/8699 issue-tracking

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-29
Last updated: 2026-11-04
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.42%

Probability of exploitation in 30 days

37.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')