External risk intelligence

Agno PandasTools Unsafe Reflection Leading to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-119050

Agno is a framework for building AI agents. While agents can be deployed as public-facing web services or APIs, they are also frequently used in internal tools, data processing pipelines, or developer environments. Because the vulnerability exists within a specific tool (PandasTools) used by these agents rather than in a dedicated internet-facing edge service, public exposure depends heavily on the specific deployment context.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Agno, a framework for building AI agents, has a vulnerability in its PandasTools component that could allow attackers to execute arbitrary code or read local files. This occurs when attackers can manipulate function names, leading the agent to invoke potentially unsafe pandas functions.

Unsafe reflection in an AI agent's tool.
High risk of code execution or data access.
Confirm relevance and exposure in your deployments.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to an AI agent that uses the PandasTools feature. This input could trick the agent into executing arbitrary Python code, potentially allowing the attacker to read local files or run other commands on the system.

Entry condition: Unauthenticated network access.
Trigger point: Prompt injection to invoke pandas functions.
Resulting risk: Arbitrary code execution and local file access.

Live Threat

Current exploitation, exposure, and threat context

An unsafe reflection vulnerability in PandasTools could allow an attacker to invoke arbitrary pandas functions. When supported by the advisory, this could lead to code execution on the system or the reading of local files by supplying crafted model inputs to `getattr()`.

System data could be read.
Attackers may inject prompts to call functions.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `Agno` framework, specifically its `PandasTools` component, presents a critical risk due to an unsafe reflection vulnerability. This could allow attackers to execute arbitrary code or access local files by manipulating function names. Identifying where `Agno` is deployed, confirming its reachability and business criticality, and pinpointing the accountable owner are the immediate first steps before planning remediation.

Application owners and platform teams should own the issue.
Verify `Agno` deployment reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Agno and why is it used?

Agno is a software framework designed for building and managing AI agents. Developers use it to create autonomous systems capable of performing complex tasks, such as processing data, interacting with external tools, or managing workflows. Its PandasTools component specifically allows these agents to interface with the pandas library, which is a common tool for data manipulation and analysis in Python environments.

What is the vulnerability in CVE-2026-119050?

This CVE involves an 'unsafe reflection' weakness, categorized as CWE-470. In plain English, the software takes instructions from an AI agent's input and uses them to dynamically select and run functions without sufficient validation. Because the code trusts these inputs, an attacker can trick the system into running sensitive operations—like loading malicious data files or executing unauthorized system commands—that were never intended to be accessible.

How can an attacker trigger this vulnerability?

The attack requires the ability to influence the AI agent's behavior, typically through prompt injection. By providing a crafted prompt, an attacker can force the agent to call unauthorized pandas functions via the vulnerable tool. Importantly, this bug is not triggered by standard usage of the pandas library itself; it only occurs when the agent is permitted to pass arbitrary, unchecked function names to the reflection mechanism.

Is my Agno deployment at risk?

According to Halo Surface Signal, risk depends on how your agent is deployed. If your Agno-powered agent is exposed as an internet-facing web service or API, it faces a higher likelihood of malicious interaction. If the agent is isolated within internal tools, data pipelines, or restricted developer environments, the threat is reduced but not eliminated. You should assess whether your specific agent setup allows external users to supply input that reaches the PandasTools component.

What are the first steps to address this issue?

Begin by auditing your environment to identify every instance where Agno is deployed. Determine if those agents use the PandasTools component. Once you have an inventory, coordinate with the platform teams or application owners responsible for these services to evaluate the exposure of each agent. Use this information to prioritize which systems require remediation and to plan an update path for your software components.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.