CVE-2026-119050: Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled paths for code execution, or call other readers to read local files.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Agno deployments using PandasTools through version 3.1.11 are exposed if an attacker can influence model behavior through prompt injection. No prior authentication or user interaction is required according to the supplied vector.
What does an attacker need to exploit it?
The attacker needs to supply prompt-injection content that causes the agent to invoke a pandas function name under attacker control. For code execution, the agent can be induced to call pandas.read_pickle with an attacker-controlled path; other reader functions may be used to access local files.
How can teams determine whether they may be affected?
Check whether the deployment uses Agno version 3.1.11 or earlier and has PandasTools available to an agent that processes untrusted or attacker-influenced prompts. Review whether model-controlled function names are passed to getattr() in the PandasTools implementation.