Critical eval() Code Execution Flaw Patched in Agno AI Agent Framework (CVE-2026-35002)

What Happened

A critical arbitrary code execution vulnerability (CVE-2026-35002, CVSS 9.3) has been disclosed in Agno, a Python AI agent framework, via GitHub Security Advisory GHSA-m4w4-3r8h-jw98. According to the advisory, versions prior to 2.3.24 pass the field_type parameter of a FunctionCall input field directly into Python's built-in eval(). An attacker who can influence that value can execute arbitrary Python code in the Agno process. The advisory classifies this as CWE-95 (code injection) and notes a public proof-of-concept exists.

Why It Matters

Agno is used to build AI agents that execute model-driven tool calls. Any deployment where FunctionCall inputs can be influenced by a user, an API caller, a web UI, or untrusted model or tool output is exposed. Because the flaw sits in the model execution path, the attack surface may not require direct end-user access. It can be reached through outputs an LLM or agent tool is already processing. The advisory states the impact is full compromise of confidentiality, integrity, and availability of the Agno process. This is severe for agent frameworks that run with broad permissions to call internal tools, APIs, or infrastructure.

What Defenders Should Do Now

• Inventory any services built on Agno and check the installed version. Upgrade to 2.3.24 or later. The advisory states the current 2.6.x line includes the fix.
• If immediate upgrade is not possible, audit all code paths that construct FunctionCall input fields to ensure field_type cannot be influenced by untrusted input. The advisory states there is no safe workaround short of this and that upgrading is strongly preferred.
• Review logs and telemetry around Agno-based agent processes for unexpected child process spawning, unusual outbound network activity, or anomalous file access.
• Treat any agent-framework component that evaluates dynamic type or field data from model or tool output as a potential injection point.

Developing Intel

This is a same-day advisory and details may evolve as the community reviews the patch (commit cbf67552, PR #5912) and any public PoC. Review the original advisory for full technical details: GHSA-m4w4-3r8h-jw98.