GHSA-m4w4-3r8h-jw98: Code Injection
Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The fieldtype parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality, integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs (for example via an API, web UI, or untrusted tool/model output) is affected.
Patches Fixed in Agno 2.3.24.
The unsafe eval() call was replaced with a fixed typemapping dictionary lookup, and fieldtype is now validated as either a known string key or an already-resolved type object before use. See commit cbf67552 (PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x) includes the fix.
Workarounds There is no safe workaround. Users who cannot upgrade should ensure no untrusted input can reach the fieldtype parameter of FunctionCall input fields, but upgrading is strongly preferred.
References - Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416 - Patch PR: https://github.com/agno-agi/agno/pull/5912 - CWE-95: https://cwe.mitre.org/data/definitions/95.html
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/agnoto a version that resolves this vulnerability.Fixed in 2.3.24 - Upgrade
Upgrade
agno-agi/agnoto a version that resolves this vulnerability.Fixed in 2.3.24
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are affected when user-influenced FunctionCall inputs can reach Agno, including through an API, web UI, or untrusted tool or model output.
What must an attacker be able to control to exploit it?
An attacker must be able to influence the field_type parameter of a FunctionCall input field. That value was passed to Python's eval(), enabling arbitrary Python code execution in the Agno process.
What should teams do if they cannot upgrade immediately?
There is no safe workaround. Until upgrading, ensure that no untrusted input can reach the field_type parameter.
Which version contains the fix?
Upgrade to Agno 2.3.24 or later. The 2.6.x release line also includes the fix.