Agno agent framework flaw lets prompts run arbitrary pandas calls

A vulnerability disclosed on 29 October 2026 affects the Agno agent framework, where a data analysis tool can be steered by prompt injection into calling arbitrary pandas functions. The flaw is tracked as CVE-2026-119050 and covers Agno through version 3.1.11, according to the entry in the US National Vulnerability Database.

The problem sits in PandasTools, the component that lets an Agno agent work with tabular data. According to the NVD entry, the tool passes a function name supplied by the model to getattr(), the Python mechanism for looking up an attribute or function by name at runtime. Because that name is model-controlled rather than restricted to a fixed list, whatever the model asks for is what gets called. The NVD description refers to this as unsafe reflection.

The practical consequences described in the advisory are twofold. An attacker who can influence the model's output, through prompt injection, can make the agent call pandas.read_pickle on a path the attacker chooses. Pickle files can carry executable content, and the NVD entry states this route leads to code execution. Alternatively, the attacker can direct the agent to other pandas reader functions to read local files. Prompt injection means hiding instructions in content the model processes, such as a document, web page or tool output, so that the agent follows them as if they came from its operator.

The NVD entry references two specific lines in the file libs/agno/agno/tools/pandas.py in the Agno repository on GitHub, along with an issue filed in the project's tracker, numbered 8699. A corresponding advisory has been published by VulnCheck, which describes the issue as code execution via PandasTools unsafe reflection.

The disclosure illustrates a recurring pattern in agent tooling. A tool that is designed to be flexible, by accepting a function name as a parameter, hands the language model a far wider range of actions than the tool's stated purpose implies. The model is not a trusted component in this arrangement: anything in its context window, including retrieved documents or earlier tool results, can shape what function name it emits. The result is that a tool intended for reading spreadsheets becomes a general-purpose means of touching the filesystem.

The advisory does not describe any exploitation in the wild, and the record as published lists the status as reported. No fixed version is named in the NVD entry. Operators running Agno should check the referenced project issue for the current state of the fix, and consider whether PandasTools is exposed to any untrusted input in their deployments, including documents, user messages or scraped content that reaches the agent's context.

The broader mitigation for this class of flaw is to constrain tools to an explicit allowlist of permitted operations rather than resolving names dynamically, and to treat file paths supplied through a model as untrusted input. Neither the NVD entry nor the VulnCheck advisory, as summarised in the published record, specifies the remediation adopted by the project. The Agno repository is linked in the advisory references.