High severity · published Oct 29, 2026
CVE-2026-119050
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
New
8.1
CVSS
–
EPSS
No
On KEV
Description
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
agno · agno-agi
through 3.1.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119050
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119050
issue-tracking
https://github.com/agno-agi/agno/issues/8699
product
https://github.com/agno-agi/agno
technical-description
https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54
technical-description
https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90
third-party-advisory
https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection
More from agno
8.8
CVE-2026-76832
Agno PythonTools Path Traversal via joinpath file_name argument
8.3
CVE-2026-10105
agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()
7.3
CVE-2026-108819
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
7.3
CVE-2026-108818
agno-agi agno auth.py get_authentication_dependency missing authentication
7.1
CVE-2025-64168
Agno session state overwrites between different sessions/users