GHSA-m4w4-3r8h-jw98

Suggest an improvement
Source
https://github.com/advisories/GHSA-m4w4-3r8h-jw98
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m4w4-3r8h-jw98/GHSA-m4w4-3r8h-jw98.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m4w4-3r8h-jw98
Aliases
Published
2026-10-27T13:30:41Z
Modified
2026-10-27T13:55:51Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
Details

Impact

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.

This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).

Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.

Patches

Fixed in Agno 2.3.24.

The unsafe eval() call was replaced with a fixed type_mapping dictionary lookup, and field_type is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).

All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.

Workarounds

There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the field_type parameter of FunctionCall input fields, but upgrading is strongly preferred.

References

Database specific 
{
    "cwe_ids":  [
        "CWE-95"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T13:30:41Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / agno

Package

Name
agno
View open source insights on deps.dev
Purl
pkg:pypi/agno

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.3.24

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.8
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13
1.1.14
1.1.15
1.1.16
1.1.17
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.8
1.5.9
1.5.10
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8
1.7.9
1.7.10
1.7.11
1.7.12
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
2.*
2.0.0a1
2.0.0rc1
2.0.0rc2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10
2.3.11
2.3.12
2.3.13
2.3.14
2.3.15
2.3.16
2.3.17
2.3.18
2.3.19
2.3.20
2.3.21
2.3.22
2.3.23

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m4w4-3r8h-jw98/GHSA-m4w4-3r8h-jw98.json"