What happened
CVE-2026-119050 (CVSS 8.1 / 9.2): Agno through 3.1.11 exposes an unsafe reflection in PandasTools that resolves model-controlled function names via getattr(). A crafted prompt injection can make the agent call pandas.read_pickle on an attacker-controlled path for code execution, or call other pandas readers to read local files. The vendor advisory/issue tracker references the vulnerable tool code and a patch discussion.
Why it matters
Prompt injection becomes host code execution inside an agent framework: an attacker who steers the agent's reasoning can turn a legitimate pandas tool into arbitrary function invocation, exfiltrating local files or running code with the agent's privileges.
Attack vector
Inject a prompt into an Agno agent that enumerates a pandas function name (e.g. read_pickle) via getattr; the agent calls the function with attacker-controlled paths, running code or reading local files.
Affected systems
Agno (agno) up to and including 3.1.11.
Mitigation
Upgrade past 3.1.11 to the patched release; constrain/whitelist the pandas functions the tool may invoke and avoid exposing file-reading tools to untrusted content.