CVE-2026-119050criticalCWE-470

CVE-2026-119050: critical vulnerability in agno-agi agno

Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Published · Updated

Follow this CVE+ Monitor agno

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.4%
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
agno-agi · agno
Related CVEs — agno-agi agno

In the same product, most dangerous first.

CVE-2025-8665MEDIUMagno-agi agno Model Context Protocol mcp.py MultiMCPTools os command injectionEPSS 1.5%CVE-2026-108817MEDIUMagno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injectionEPSS 1.1%CVE-2026-108818MEDIUMagno-agi agno auth.py get_authentication_dependency missing authenticationEPSS 0.4%CVE-2026-10105HIGHagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()EPSS 0.4%CVE-2026-108819MEDIUMagno-agi agno Agent Orchestration Layer exec dynamically-managed code resourcesEPSS 0.3%CVE-2026-108820MEDIUMagno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privilegesEPSS 0.3%