CVE-2026-119050: Agno PandasTools lets a prompt-injected agent call any pandas function, including read_pickle for code execution, still unfixed
Agno's PandasTools toolkit calls getattr on pandas with whatever function name the model chooses, so prompt injection can make an agent call read_pickle (which runs code when it loads a malicious pickle) or read local files. NVD lists Agno through 3.1.11 as affected, and the GitHub issue is still open with no fixed release, so turn these tools off for agents that see untrusted content.
What it is
create_pandas_dataframe runs getattr(pd, create_using_function)(**function_parameters), and run_dataframe_operation runs getattr(dataframe, operation)(**operation_parameters). Both names come from the model with no allowlist.
An attacker who can get text in front of the agent (a web page, document, email or tool result) can steer it to call pandas.read_pickle on an attacker-controlled file, which runs arbitrary Python code, or to read local files.
The issue (agno-agi/agno#8699) was confirmed by a commenter in September 2026 and remains open; the PandasTools code on main still uses the open getattr call as of 30 October.
How to check
- Search your code for PandasTools or agno.tools.pandas.
- Check whether those agents read anything you don't fully control, such as user uploads, web content, emails or other tools' output.
How to fix
- Remove PandasTools, or turn off both of its functions with enable_create_pandas_dataframe=False and enable_run_dataframe_operation=False, until a fixed release ships.
- If you need dataframe work, write your own narrow tool that only exposes the specific pandas calls you allow.
- Run agents that handle untrusted content in a sandbox without access to secrets or sensitive files.
from agno.tools.pandas import PandasTools
# both open-dispatch functions off until Agno ships a fix
pandas_tools = PandasTools(
enable_create_pandas_dataframe=False,
enable_run_dataframe_operation=False,
)