Agno PandasTools: Code execution via unsafe reflection
Summary
Agno through 3.1.11 contains an unsafe reflection flaw in the PandasTools toolkit. The tool passes model-supplied function names to getattr() on pandas, so an attacker who can influence the agent's input (for example through prompt injection in documents or messages) can make it call pandas.read_pickle on attacker-controlled paths to execute code, or call other readers to read local files. The CVSS 4.0 score is 9.2 (critical), and the reporter states that the default configuration is affected.
Affected
- Agno up to and including 3.1.11 (per the CVE record; the exact range is not fully confirmed)
- Only installations where PandasTools is enabled
Fixed in
Unknown. No vendor fix was found at the time of research.
Workaround
- Disable PandasTools on agents that process email, web content, uploaded files or other untrusted input.
- Do not let model output select function names or arbitrary library functions; use fixed, predefined operations.
- Restrict agent file access to least privilege so that pickle or other file reads cannot reach sensitive paths.
- Do not load pickle files from untrusted sources.
Exploitation
- No confirmed exploitation in the wild and no CISA KEV listing found at the time of research.
- The root cause is described in public issue #8699, and VulDB rates exploitability as easy.
- EPSS: 0.43% (percentile 37).
Our recommendation
- Inventory all Agno installations and check whether PandasTools is enabled.
- Disable PandasTools or apply the workarounds above on any agent that handles untrusted content.
- Monitor the Agno releases, issue #8699, and the NVD and VulnCheck records for a fix, as the NVD status is currently Deferred.
- Review agent tool logs for unexpected pandas calls.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-119050 mirror (threatint) cve.threatint.com
- VulnCheck advisory www.vulncheck.com
- Agno issue #8699 github.com
- Agno repository github.com
- VulDB entry 428412 vuldb.com
- pandas.py at d9ab0a7 (L54) github.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:55.
Original description (NVD)
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
NVD references (5)
- https://github.com/agno-agi/agno
- https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py…
- https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py…
- https://github.com/agno-agi/agno/issues/8699
- https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.