Agno Arbitrary Code Execution Vulnerability in Model Execution Component
Vulnerability
A vulnerability allowing arbitrary code execution exists in Agno versions prior to 2.3.24. This issue arises in the model execution component, where the field_type parameter passed to eval() can be manipulated. Attackers can influence the field_type value in a FunctionCall to execute arbitrary Python code remotely.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the server where Agno is running.
Remediation
Users can upgrade to Agno version 2.3.24 or later to address this vulnerability.
Added: May 3, 2026, 11:25 AM
Updated: May 3, 2026, 11:25 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
7.5exploitability
7.5remediation
0.0relevance
5.1threat
3.2urgency
2.9incentive
4.2Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.