{"id":"ghsa-ghsa-m4w4-3r8h-jw98","seq":1708829,"kind":"advisory","title":"Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`","url":"https://github.com/advisories/GHSA-m4w4-3r8h-jw98","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m4w4-3r8h-jw98","summary":"影響: pip:agno < 2.3.24 → 2.3.24\nAgno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes Agno to user-influe…","severity":"critical","techs":["python"],"cves":["CVE-2026-35002"],"tags":["GHSA-m4w4-3r8h-jw98","agno"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T13:30:41.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}