Cpe:2.3:a:agno:agno:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aagnoagno/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:37:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAgno: Unsafe reflection in PandasTools (CVE-2026-119050)https://feed.craftedsignal.io/briefs/2026-10-agno-pandas-tools-rce/Thu, 29 Oct 2026 15:37:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-agno-pandas-tools-rce/Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions via prompt injection.Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.

]]>highadvisory