CVE-2026-35002: 
Python vulnerability analysis and mitigation

CVE-2026-35002 is an eval injection vulnerability in the Agno AI agent framework (pip package) that allows unauthenticated remote attackers to execute arbitrary Python code. All versions of Agno prior to 2.3.24 are affected. The vulnerability was published on April 2, 2026, with a patch released in version 2.3.24. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, Feedly).

The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'). In the vulnerable code path within libs/agno/agno/models/base.py and libs/agno/agno/tools/function.py, the field_type parameter extracted from a FunctionCall's user_input_fields argument was passed directly to Python's built-in eval() function without sanitization, allowing arbitrary Python expressions to be evaluated. The fix replaced eval() with a safe dictionary lookup mapping only known type strings (str, int, float, bool, list, dict) to their corresponding Python types. No authentication or user interaction is required to trigger the vulnerable code path (Github Commit, Github Advisory).

Successful exploitation grants an unauthenticated network attacker the ability to execute arbitrary Python code on the host running the Agno framework, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read or exfiltrate sensitive data, modify or destroy system data, disrupt service availability, and potentially pivot to other systems accessible from the compromised host. Because no privileges or user interaction are required, the attack surface is broad for any internet-exposed Agno deployment (Github Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.59% (0.00586), placing it in the 36th percentile for exploitation probability within 30 days (Github Advisory). No threat actor attribution has been reported. The vulnerability was assigned and disclosed by VulnCheck (Feedly).

1. Reconnaissance: Identify internet-facing services or APIs built on the Agno framework (pip package agno versions < 2.3.24) using network scanning tools or by inspecting application dependencies.
2. Identify the vulnerable endpoint: Locate an API endpoint or interface that invokes Agno's model execution component and processes FunctionCall arguments, specifically those containing user_input_fields with a field_type key.
3. Craft a malicious payload: Construct a FunctionCall request where the field_type value within user_input_fields contains an arbitrary Python expression, such as __import__('os').system('id') or a reverse shell payload.
4. Submit the payload: Send the crafted request to the target Agno-powered service. The vulnerable code in base.py or function.py passes the attacker-controlled field_type string directly to eval(), executing the injected Python code in the server's runtime context.
5. Achieve code execution: The injected code runs with the privileges of the Agno process, enabling data exfiltration, reverse shell establishment, or further lateral movement (Github Commit, Github Advisory).

• Logs: Application or server logs showing unexpected Python exceptions or unusual output from the Agno model execution component; log entries referencing eval() with non-standard type strings (anything other than str, int, float, bool, list, dict).
• Process: Unexpected child processes spawned by the Agno Python process (e.g., sh, bash, curl, wget, python3) that are not part of normal agent operation.
• Network: Unusual outbound connections from the Agno server process to external IP addresses, particularly on non-standard ports, which may indicate reverse shell or data exfiltration activity.
• File System: Unexpected new files, scripts, or cron jobs created in directories accessible by the Agno service account; presence of web shells or persistence mechanisms in the application directory.

Upgrade the Agno pip package to version 2.3.24 or later, which replaces the unsafe eval() call with a safe dictionary-based type mapping (Github Advisory, Agno Release). The fix was committed on April 16, 2026 (commit cbf6755). Until patching is complete, isolate Agno instances from untrusted network sources and restrict access to model execution endpoints using network-level controls such as firewalls or API gateways (Feedly).

The vulnerability was discovered and disclosed by VulnCheck, who published an advisory detailing the eval injection mechanism (VulnCheck Advisory). A technical write-up was also published by Infinitsec covering the field_type eval injection (Infinitsec). The CVE was noted on social platforms including Bluesky. Community reaction has been limited, consistent with the absence of active exploitation.