AIKIDO-2026-39577
agno is vulnerable to Code Injection
98
Critical Risk
This Affects:
agnoTL;DR
The model execution component passes the field_type value from a FunctionCall input field directly to Python's eval(). A value that reaches this parameter through API endpoints, tool output, or model responses is evaluated as Python code. This allows execution of arbitrary code in the process running the agent. The fix replaces the eval() call with a validated lookup that only accepts known type keys or already-resolved type objects.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment exposes agent function-calling to user-influenced or untrusted model/tool input.
Background info
agno is vulnerable to Code Injection in versions 1.5.4 - 2.3.23.
How to fix this
Upgrade the agno library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant