긴급취약점 권고Python2026. 10. 27. 오후 10:30

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

影響: pip:agno < 2.3.24 → 2.3.24

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process. This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical). Any deployment that exposes Agno to user-influe…

GitHub Advisory Database에서 읽기

CVE	CVE-2026-35002
정보원	GitHub Advisory Database
수집 시각	2026. 10. 28. 오전 06:03
데이터	Markdown　JSON

2026. 10. 27. 오후 10:30, GitHub Advisory Database에서 "Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "긴급"(critical)입니다. 관련 기술: Python. CVE: CVE-2026-35002.