---
id: 2026-10-agno-pandastools-model-chosen-pandas-function-read-pickle-rce-cve-2026-119050-no-fix
title: "Agno through 3.1.11: PandasTools calls any pandas function the model names, including read_pickle (CVE-2026-119050, 9.2); no fix merged"
date_disclosed: 2026-10-29
last_updated: 2026-10-29
severity: high
status: active
ecosystems: [pypi, python, agent-framework]
tools_affected: ["agno (PyPI) through 3.1.11 per the record, with PandasTools enabled; 3.1.12 (PyPI 2026-10-29) is not known to be fixed", "any Agno agent that reads untrusted content (web pages, documents, tool output) while PandasTools is loaded"]
tags: [cve, vulncheck, agno, agent-framework, unsafe-reflection, getattr, read_pickle, deserialization, prompt-injection-to-rce, no-fix, open-issue, unmerged-pr, range-frozen-at-report-time]
---

## TL;DR
Agno's `PandasTools` picks a pandas function from a string the model supplies and calls it with model-supplied keyword arguments, so a prompt-injected agent can call `pandas.read_pickle` on an attacker path for code execution, or any reader to read local files or fetch URLs (CVE-2026-119050, VulnCheck 2026-10-29, CVSS 4.0 9.2, 3.1 8.1). The issue was opened on the vendor repository on 2026-07-02 with a fix PR that is still unmerged and no maintainer reply; the record says "through 3.1.11", 3.1.12 reached PyPI on 2026-10-29 and is not known to contain a fix. Remove or do not enable PandasTools on any agent that reads content you do not control.

## What happened

- **2026-07-02.** Issue #8699 ("[Security] PandasTools: RCE via model-controlled pandas function selection (read_pickle)", bogdancherniy11-sudo) reports that `libs/agno/agno/tools/pandas.py` resolves a function name from the model with `getattr()` on `pandas` and calls it with model-supplied kwargs; both affected tools are enabled by default; the author proposes an allowlist of safe constructors and a block on code-executing DataFrame methods, opens PR #8713, and notes that private vulnerability reporting appeared disabled and no `SECURITY.md` was found. The only comment when read (akavlabs, 2026-09-28) agrees the dispatch is the problem and recommends an allowlist; the commenter discloses a commercial proxy product. No maintainer comment; the issue and the PR are open.
- **2026-10-29.** VulnCheck publishes CVE-2026-119050: "Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files." CVSS 4.0 9.2 (`AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H`), CVSS 3.1 8.1. Credits: bogdancherniy11-sudo, mosafariuk. References: the issue, the repository and two lines of `pandas.py` at commit d9ab0a7; no fix reference.

**Versions.** The record's "through 3.1.11" is the version current when the record was written. PyPI shows 3.1.9 (2026-10-22), 3.1.10 (10-23), 3.1.11 (10-27) and 3.1.12 (2026-10-29, newest). With the fix PR unmerged and no release note read this run naming the bug, 3.1.12 is not known to be fixed; this file treats every release as affected until the vendor says otherwise.

**Severity.** The CNA rates 9.2 with high attack complexity and a precondition (the tool must be loaded and the model must be steered). This file says `high`: the path needs prompt injection into an agent that has PandasTools enabled, which is a configuration choice, and the outcome is code execution as the agent process. The two Agno records already here, CVE-2026-35002 (fixed 2.3.24) and the tool-confirmation bypass (unconfirmed), are different bugs in different files.

## Am I affected?

```bash
pip show agno 2>/dev/null | grep -i ^version                      # any version through 3.1.12 is in scope
grep -rn "PandasTools" --include=*.py . | grep -v site-packages   # the tool must be loaded for the path to exist
```

- Loaded PandasTools plus any untrusted input (documents, web pages, retrieved text, another agent's output) is the exposure. A pickle file the agent can reach by path, including one it downloads, is enough.

## If you are affected

1. Remove `PandasTools` from the agent's tool list, or wrap it so only an operator-defined allowlist of constructors (`read_csv`, `read_json`, `DataFrame`) is callable and `read_pickle` is not; the issue's proposal is the shape of the fix.
2. Run the agent process with no credentials it does not need and no network egress by default: [agent sandboxing](../prevention/agent-sandboxing.md).
3. If an agent with the tool loaded processed content you did not control, review what it executed: [if your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md).

## Prevention

- [Agent sandboxing](../prevention/agent-sandboxing.md): a tool that dispatches on a model-chosen name is `eval` with a different spelling.
- [MCP hygiene](../prevention/mcp-hygiene.md) for the same rule applied to tool servers.

## Sources
- [CVE Services — CVE-2026-119050](https://cveawg.mitre.org/api/cve/CVE-2026-119050) — fetched 2026-10-29: CNA VulnCheck, published 2026-10-29, "through 3.1.11", the description, CVSS 4.0 9.2 and 3.1 8.1, the references and credits.
- [agno-agi/agno — issue #8699](https://github.com/agno-agi/agno/issues/8699) — fetched 2026-10-29: opened 2026-07-02, open, the mechanism, the allowlist proposal, PR #8713 open, the 2026-09-28 comment, no maintainer response.
- PyPI `agno` release history, read 2026-10-29: 3.1.9 (10-22), 3.1.10 (10-23), 3.1.11 (10-27), 3.1.12 (10-29).
- Related in this corpus: [Agno FunctionCall field_type eval() RCE, CVE-2026-35002, fixed 2.3.24](2026-10-agno-function-call-field-type-eval-rce-fixed-2-3-24.md), [Agno tool-call confirmation gate and team delegation (VulDB CVEs)](2026-10-agno-tool-call-confirmation-gate-team-delegation-vuldb-cves.md).