GHSA-77rh-m34w-rv36

Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

Published

2026-04-02

Modified

2026-10-27

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4w4-3r8h-jw98. This link is maintained to preserve external references. ### Original Description Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

Affected packages

Remediation: Upgrade to 2.3.24 or later.

References

• https://github.com/advisories/GHSA-77rh-m34w-rv36