CVE-2026-119050 Details
Description
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
A vulnerability exists in Agno versions through 3.1.11, specifically within the PandasTools component. This vulnerability allows for unsafe reflection, enabling attackers to invoke arbitrary pandas functions by manipulating function names passed to getattr(). Exploitation can be achieved through prompt injection, causing the agent to execute pandas.read_pickle on attacker-controlled paths, leading to remote code execution. Alternatively, other pandas readers could be used to access local files.
Users can update to Agno version 3.1.12 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/agno-agi/agno/issues/8699 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/agno-agi/agno | [email protected] | Vendor |
| https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54 | [email protected] | Source CodeVendor |
| https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90 | [email protected] | Source CodeVendor |
| https://github.com/agno-agi/agno/issues/8699 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Agno | <= 3.1.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |