Advisory · CVE-2026-119050
Prompt injection can drive Agno PandasTools to remote code execution
Agno through 3.1.11 lets model-controlled input choose any pandas function in PandasTools, so a prompt-injected model can call read_pickle on attacker-controlled data and execute code on the agent host. It is rated critical at CVSS 4.0 9.2.
- Vendor
- Agno
- Product
- Agno
- Identifier / CWE
- CVE-2026-119050
CWE-470 - Action timing
- Immediate
Explain it like I’m five
Agno hands the AI model a menu of pandas tools, but the model can write in any item it wants, including one that unpacks files. A prompt injection tricks the model into ordering the dangerous item, and unpacking it runs the attacker's code.
- 01Agent with PandasTools
An agent is configured with PandasTools, a standard toolkit enabled by default.
- 02Prompt injection
Untrusted input, such as a document or web page the agent ingests, steers the model tool call.
- 03Unsafe dispatch
The model-controlled function name is passed to getattr on pandas with model-controlled arguments, with no allowlist.
- 04Pickle code execution
The model calls read_pickle on an attacker-controlled path or URL, and deserialization executes the payload on the agent host.
What happened
Agno disclosed CVE-2026-119050 in versions through 3.1.11: PandasTools selects the pandas callable to run from a model-controlled string and calls it with model-controlled arguments, with no allowlist. A prompt-injection-controlled model can choose read_pickle, which deserializes attacker-supplied data and executes code on the host running the agent, or use other readers to read local files. It is rated critical at CVSS 4.0 9.2, with high attack complexity and an attack requirement present.
The same dispatch pattern also affects the dataframe operation tool, which exposes code-executing methods. Agents that ingest untrusted documents or web content are the realistic trigger: the attacker never needs direct access to the agent host.
What to do
- Inventory agents using Agno PandasTools, especially any that ingest untrusted documents, web pages, or user content.
- Upgrade Agno past 3.1.11 to a version that restricts PandasTools to an allowlist of safe constructors.
- Until upgraded, disable PandasTools or restrict it to trusted inputs only, and never let it process untrusted content.
- Review agent tool-call logs for read_pickle, read_hdf, query, eval, or to_pickle invocations.
- Rotate credentials and tokens that were reachable from agent hosts if suspicious tool calls appear.
Management note
This is the AI-agent version of a classic unsafe-dispatch flaw, and prompt injection is the delivery mechanism. Any Agno agent touching untrusted content should lose PandasTools until patched.