Agno PandasTools: Code execution via unsafe reflection
Agno through 3.1.11 contains an unsafe reflection flaw in the PandasTools toolkit. The tool passes model-supplied function names to getattr() on pandas, so an attacker who can influence the agent's input (for example through prompt injection in documents or messages) can make it call pandas.read_pickle on attacker-controlled paths to execute code, or call other readers to read local files. The CVSS 4.0 score is 9.2 (critical), and the reporter states that the default configuration is affected.
agno-agi · Agno
