CVE-2026-35002

CRITICAL

9.8

Descripcion

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado4/2/2026

Ultima modificacion4/16/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

agno:agno

Debilidades (CWE)

CWE-95

Referencias

https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416(disclosure@vulncheck.com)

https://github.com/agno-agi/agno/releases/tag/v2.3.24(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.