Is Agno patched against CVE-2026-119050?

Agno has no released fix for CVE-2026-119050. Pull request 8713, opened by the reporter on July 2, 2026, was still open and carried no maintainer review, and the release notes for Agno 3.1.12, published on October 29, 2026, list no security change. VulnCheck records the affected range as Agno through 3.1.11, so teams should assume current installs are exposed.

Am I affected if my Agno agent does not use PandasTools?

Agno agents without the PandasTools toolkit do not expose this path, because the flaw sits in that toolkit's dispatch of model-supplied pandas function names. Check each agent's tool list for PandasTools, and remember that an attacker only needs text the agent reads, such as a document, a web page or a support ticket, to steer the call.

How can a pandas function run attacker code?

pandas.read_pickle deserializes a Python pickle file, and unpickling runs code that the file contains. VulnCheck describes the agent being steered to call read_pickle on an attacker-controlled path, which is enough for code execution in the process running the agent. Other readers in the same dispatch return local file contents rather than executing code.

What can I do if I need dataframe tools in Agno today?

Restrict which pandas entry points the toolkit can reach. The open pull request limits creation to an allowlist of safe pandas constructors, leaves out read_pickle and read_hdf, and blocks private attributes along with query, eval, to_pickle and to_hdf. Applying the same restriction in your own wrapper keeps dataframe tools working while closing the code execution path.

HIGHVulnerability

Agno: a prompt can make the pandas tool run attacker code

Agno's PandasTools lets the model choose which pandas function to call, so injected text can reach code execution.

October 29, 2026 · VulnCheck · Research by Bogdan Cherniy, mosafariuk

CVE-2026-119050

HIGHVulnerability

Agno's PandasTools picks a pandas function from model-controlled input, so a prompt injection can call read_pickle on an attacker's file and run code. VulnCheck published CVE-2026-119050 at 9.2 on October 29, 2026, and no fix has shipped.

01What happened

VulnCheck published CVE-2026-119050 for Agno on October 29, 2026 and rated it 9.2, Critical. Bogdan Cherniy, who describes himself as a security researcher hunting bugs in open-source AI and ML tools, filed the flaw as a public GitHub issue on July 2, 2026 and opened a fix pull request the same day. VulnCheck credits Cherniy and mosafariuk.

02How it works

PandasTools passes a model-supplied function name to getattr() on the pandas module, so the agent can invoke any pandas function. VulnCheck describes a prompt injection that makes the agent call pandas.read_pickle on a path the attacker controls, which unpickles the file and runs code. Other pandas readers reached through the same dispatch return local file contents instead. VulnCheck classifies the weakness as CWE-470, unsafe reflection.

03Who is affected

VulnCheck lists Agno releases through 3.1.11 as affected, and exposure depends on whether an agent loads the PandasTools toolkit. Agents that read untrusted documents, web pages or support tickets are the ones an injected instruction can steer. The release notes for Agno 3.1.12, published on October 29, 2026, list no security change.

04What to do

Remove PandasTools from agents that handle untrusted input until a fix ships. Teams that need dataframe tools can wrap them in an allowlist of safe pandas constructors, which is what the open pull request does by leaving out read_pickle and read_hdf.

Questions people ask

Is Agno patched against CVE-2026-119050?: Agno has no released fix for CVE-2026-119050. Pull request 8713, opened by the reporter on July 2, 2026, was still open and carried no maintainer review, and the release notes for Agno 3.1.12, published on October 29, 2026, list no security change. VulnCheck records the affected range as Agno through 3.1.11, so teams should assume current installs are exposed.
Am I affected if my Agno agent does not use PandasTools?: Agno agents without the PandasTools toolkit do not expose this path, because the flaw sits in that toolkit's dispatch of model-supplied pandas function names. Check each agent's tool list for PandasTools, and remember that an attacker only needs text the agent reads, such as a document, a web page or a support ticket, to steer the call.
How can a pandas function run attacker code?: pandas.read_pickle deserializes a Python pickle file, and unpickling runs code that the file contains. VulnCheck describes the agent being steered to call read_pickle on an attacker-controlled path, which is enough for code execution in the process running the agent. Other readers in the same dispatch return local file contents rather than executing code.
What can I do if I need dataframe tools in Agno today?: Restrict which pandas entry points the toolkit can reach. The open pull request limits creation to an allowlist of safe pandas constructors, leaves out read_pickle and read_hdf, and blocks private attributes along with query, eval, to_pickle and to_hdf. Applying the same restriction in your own wrapper keeps dataframe tools working while closing the code execution path.

Sources 3 links, all fetched

1vulncheck.comVulnCheck Advisory
2github.comGitHub Issue 8699
3github.comFix Pull Request