Agno through 3.1.11: PandasTools calls any pandas function the model names, including read_pickle (CVE-2026-119050, 9.2); no fix merged

View raw markdownEdit on GitHub ↗

TL;DR

Agno's PandasTools picks a pandas function from a string the model supplies and calls it with model-supplied keyword arguments, so a prompt-injected agent can call pandas.read_pickle on an attacker path for code execution, or any reader to read local files or fetch URLs (CVE-2026-119050, VulnCheck 2026-10-29, CVSS 4.0 9.2, 3.1 8.1). The issue was opened on the vendor repository on 2026-07-02 with a fix PR that is still unmerged and no maintainer reply; the record says "through 3.1.11", 3.1.12 reached PyPI on 2026-10-29 and is not known to contain a fix. Remove or do not enable PandasTools on any agent that reads content you do not control.

What happened

  • 2026-07-02. Issue #8699 ("[Security] PandasTools: RCE via model-controlled pandas function selection (read_pickle)", bogdancherniy11-sudo) reports that libs/agno/agno/tools/pandas.py resolves a function name from the model with getattr() on pandas and calls it with model-supplied kwargs; both affected tools are enabled by default; the author proposes an allowlist of safe constructors and a block on code-executing DataFrame methods, opens PR #8713, and notes that private vulnerability reporting appeared disabled and no SECURITY.md was found. The only comment when read (akavlabs, 2026-09-28) agrees the dispatch is the problem and recommends an allowlist; the commenter discloses a commercial proxy product. No maintainer comment; the issue and the PR are open.
  • 2026-10-29. VulnCheck publishes CVE-2026-119050: "Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files." CVSS 4.0 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H), CVSS 3.1 8.1. Credits: bogdancherniy11-sudo, mosafariuk. References: the issue, the repository and two lines of pandas.py at commit d9ab0a7; no fix reference.

Versions. The record's "through 3.1.11" is the version current when the record was written. PyPI shows 3.1.9 (2026-10-22), 3.1.10 (10-23), 3.1.11 (10-27) and 3.1.12 (2026-10-29, newest). With the fix PR unmerged and no release note read this run naming the bug, 3.1.12 is not known to be fixed; this file treats every release as affected until the vendor says otherwise.

Severity. The CNA rates 9.2 with high attack complexity and a precondition (the tool must be loaded and the model must be steered). This file says high: the path needs prompt injection into an agent that has PandasTools enabled, which is a configuration choice, and the outcome is code execution as the agent process. The two Agno records already here, CVE-2026-35002 (fixed 2.3.24) and the tool-confirmation bypass (unconfirmed), are different bugs in different files.

Am I affected?

pip show agno 2>/dev/null | grep -i ^version                      # any version through 3.1.12 is in scope
grep -rn "PandasTools" --include=*.py . | grep -v site-packages   # the tool must be loaded for the path to exist
  • Loaded PandasTools plus any untrusted input (documents, web pages, retrieved text, another agent's output) is the exposure. A pickle file the agent can reach by path, including one it downloads, is enough.

If you are affected

  1. Remove PandasTools from the agent's tool list, or wrap it so only an operator-defined allowlist of constructors (read_csv, read_json, DataFrame) is callable and read_pickle is not; the issue's proposal is the shape of the fix.
  2. Run the agent process with no credentials it does not need and no network egress by default: agent sandboxing.
  3. If an agent with the tool loaded processed content you did not control, review what it executed: if your local AI agent was exploited.

Prevention

  • Agent sandboxing: a tool that dispatches on a model-chosen name is eval with a different spelling.
  • MCP hygiene for the same rule applied to tool servers.

Sources