CVE-2026-119050: Agno PandasTools lets prompt injection make the agent call arbitrary pandas functions, including reading pickle files for code execution
The National Vulnerability Database (NVD) record says Agno through 3.1.11 has an unsafe reflection vulnerability in PandasTools that passes model-controlled function names to getattr(), so attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.
The record
- Kind
- Vulnerability
- Source record
- CVE-2026-119050: Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke (National Vulnerability Database record)
- Record published
- 2026-10-29
- Posted here
- 2026-10-30
- World
- Software agents · Enterprise work agents
- Controls concerned
- Retrieved content as data C-I1; Containment and isolation C-E5
- Checked
- Checked against its record on 2026-10-30 by a reader who did not draft it; report
verification/reports/SIG-2026-10-30-006-2026-10-30.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailNewer: CVE-2026-62863: MoLing, a computer-use and browser-use Model Context Protocol (MCP) server, accepts unauthenticated tool calls that a malicious web page can send in Server-Sent Events (SSE) mode
Older: CVE-2026-110193: IBM Langflow OSS Agentic Assistant can be made to generate or submit code that runs operating system commands