Agno-agi vulnerabilities
We track 6 vulnerabilities in Agno-agi products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Agno-agi vulnerabilities
- 8.1 High severity
agno: Use of Externally-Controlled Input to Select Classes or Code
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call panda
- 7.3 High severity
agno: Improper Control of Dynamically-Managed Code Resources
A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remot
- 7.3 High severity
agno: Improper Authentication
A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely.
- 8.8 High severity
Agno: Improper Limitation of a Pathname to a Restricted Directory
Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_
- 8.3 High severity
agno: Improper Neutralization of Special Elements used in an SQL Command
agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the
- 7.1 High severity
agno: Concurrent Execution using Shared Resource with Improper Synchronization
Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persi