CVE-2026-35002 is a critical code injection flaw in Agno, a Python agent framework. NVD scores it 9.8. Before 2.3.24, a manipulated field_type value passed to eval can run arbitrary Python. Upgrade to Agno 2.3.24 or later. Pin the fixed version in every environment that runs agents.
What's affected
Agno before 2.3.24. The fixed release is 2.3.24.
The record says an attacker can influence the field_type value in a FunctionCall, which reaches eval in the model execution component.
How to check if you're exposed
Check the installed version:
pip show agno
Cover notebooks, containers and CI images too. Then look at where your agents take tool call data from, and whether any of it comes from outside your control.
What to do now
- Upgrade with
pip install -U agnoand confirm 2.3.24 or later. - Pin the version in your requirements or lock file.
- Run agents with the least privilege you can: no broad cloud credentials, no write access to sensitive paths.
- Review any custom code of your own that calls eval or exec on model output.
Why it matters
The weakness is CWE-95, eval injection. The code takes a string that an outsider can influence and evaluates it as Python. That means input becomes code.
Agent frameworks pass structured data between a model and tools, and any field in that exchange that reaches an interpreter is a risk. The safer pattern is to map the field to an allowlist of types instead of evaluating text.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. The VulnCheck advisory is linked from the record.
Check notebooks and one off scripts as well as services. Agent projects tend to start as experiments and spread, so the same package can sit in many places with different pins. A dependency inventory helps you find them, and the free dependency scan at https://gold.safeguard.sh/scan can check a requirements file in your browser.
Quick check
Does the attacker need an account?
The vector shows no privileges and no user interaction. How exposed you are depends on whether outside input reaches your agent's function call handling.
Sources
Last reviewed: 19 October 2026.
