{"metadata": {"vulnerability": "CVE-2026-35002", "count": 21, "kinds": {"milestone": 6, "sighting": 4, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-03-31T20:40:15.617Z", "date_only": false, "value": "2026-03-31T20:40:15.617Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-02T14:34:14.538Z", "date_only": false, "value": "2026-04-02T14:34:14.538Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-02T15:16:52Z", "date_only": false, "value": "2026-04-02T15:16:52Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-77RH-M34W-RV36", "record": "GHSA-77RH-M34W-RV36", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-04-02T15:16:52.063Z", "date_only": false, "value": "2026-04-02T15:16:52.063", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35002", "record": "FKIE_CVE-2026-35002", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-04-02T15:23:11.274Z", "date_only": false, "value": "2026-04-02T15:23:11.274152Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35002", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-04-02T15:23:11.274Z", "date_only": false, "value": "2026-04-02T15:23:11.274152Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35002", "record": "FKIE_CVE-2026-35002", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-04-02T15:23:20.841Z", "date_only": false, "value": "2026-04-02T15:23:20.841Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-35002", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-04-02T15:31:43Z", "date_only": false, "value": "2026-04-02T15:31:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-77RH-M34W-RV36", "record": "GHSA-77RH-M34W-RV36", "field": "published"}, {"timestamp": "2026-04-02T17:18:39.091Z", "date_only": false, "value": "2026-04-02T17:18:39.091644Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mijpm4axuq2j", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "d0203933-f409-461d-a3cb-b1e178ccff14", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mijpm4axuq2j"}, {"timestamp": "2026-04-02T17:38:06Z", "date_only": false, "value": "2026-04-02T17:38:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwam_g57gd_s1UAnW3xco8kE", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "395320c7-b61d-4d14-a933-b68b748ff662", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-29T11:50:46.517Z", "date_only": false, "value": "2026-06-29T11:50:46.517573Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-256", "record": "PYSEC-2026-256", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-01T20:22:47.645Z", "date_only": false, "value": "2026-07-01T20:22:47.645877Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-256", "record": "PYSEC-2026-256", "field": "modified"}, {"timestamp": "2026-10-08T15:22:31.629Z", "date_only": false, "value": "2026-10-08T15:22:31.629Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-08T15:22:31.629Z", "date_only": false, "value": "2026-10-08T15:22:31.629Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-35002", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T16:17:14.047Z", "date_only": false, "value": "2026-10-08T16:17:14.047", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-35002", "record": "FKIE_CVE-2026-35002", "field": "lastModified"}, {"timestamp": "2026-10-27T13:30:35Z", "date_only": false, "value": "2026-10-27T13:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-77RH-M34W-RV36", "record": "GHSA-77RH-M34W-RV36", "field": "modified"}, {"timestamp": "2026-10-27T13:30:35Z", "date_only": false, "value": "2026-10-27T13:30:35Z", "kind": "other", "label": "Withdrawn", "source": "github \u00b7 GHSA-77RH-M34W-RV36", "record": "GHSA-77RH-M34W-RV36", "field": "withdrawn"}, {"timestamp": "2026-10-27T13:30:41Z", "date_only": false, "value": "2026-10-27T13:30:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M4W4-3R8H-JW98", "record": "GHSA-M4W4-3R8H-JW98", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T13:30:42Z", "date_only": false, "value": "2026-10-27T13:30:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M4W4-3R8H-JW98", "record": "GHSA-M4W4-3R8H-JW98", "field": "modified"}, {"timestamp": "2026-10-27T14:30:50Z", "date_only": false, "value": "2026-10-27T14:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/751d3cd21b1c9dd5ca482d371cb23ebc", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "428b8093-0196-41cd-95ef-accb7bbc1e5e", "content": "# CVE-2026-35002: CVE-2026-35002: Eval Injection and Arbitrary Code Execution in Agno Agent Platform\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-35002\n\n## Summary\nCVE-2026-35002 is an arbitrary code execution vulnerability in the Agno agent platform (formerly Phidata) affecting all versions prior to 2.3.24. The flaw resides in the model execution logic (libs/agno/agno/models/base.py) and tool serialization logic (libs/agno/agno/tools/function.py), where the application directly passes the field_type string parameter into Python's built-in eval() function to resolve string type names into Python data types. An attacker who can influence FunctionCall arguments via prompt injection or supply untrusted dictionary structures for deserialization can execute arbitrary Python expressions within the context of the host process.\n\n## TL;DR\nAgno versions prior to 2.3.24 use Python's eval() function to resolve string type names in the field_type parameter during function calling and tool deserialization. Replacing type strings with arbitrary Python expressions allows unauthenticated remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-95 (Eval Injection)\n- **CVSS v3.1 Score**: 9.8 (Critical)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Attack Vector**: Network (AV:N)\n- **Impact**: Arbitrary Code Execution (RCE)\n- **EPSS Score**: 1.15% (66.68th Percentile)\n- **Exploit Status**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Agno Agent Platform (PyPI package: agno)\n- **Agno**: < 2.3.24 (Fixed in: `2.3.24`)\n\n## Mitigation\n\n- Upgrade the Agno package to version 2.3.24 or later to eliminate the eval() injection sink.\n- Implement strict schema validation on all external dictionary data prior to calling deserialization helpers such as UserInputField.from_dict().\n- Restrict network egress and apply least-privilege execution contexts (such as isolated containers or sandboxes) for LLM agent worker processes.\n- Use static application security testing (SAST) rules to detect and block dynamic evaluation functions like eval() and exec() in Python codebases.\n\n**Remediation Steps:**\n1. Audit all Python environments and dependency lockfiles using 'pip list | grep -i agno' to locate installations running versions prior to 2.3.24.\n2. Update the dependency specification in requirements.txt, pyproject.toml, or Pipfile to require 'agno>=2.3.24'.\n3. Execute 'pip install --upgrade \"agno>=2.3.24\"' and rebuild affected application containers.\n4. Rotate any API keys, database credentials, or cloud IAM tokens accessible to the Agno process if the application was exposed to untrusted external inputs prior to patching.\n\n## References\n\n- [GitHub Fix Commit: replace eval() with type mapping [SDK-417] (#5912)](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)\n- [Agno v2.3.24 Release Notes](https://github.com/agno-agi/agno/releases/tag/v2.3.24)\n- [VulnCheck Advisory: Agno field_type Eval Injection Arbitrary Code Execution](https://www.vulncheck.com/advisories/agno-field-type-eval-injection-arbitrary-code-execution)\n- [National Vulnerability Database (NVD) - CVE-2026-35002](https://nvd.nist.gov/vuln/detail/CVE-2026-35002)\n- [CVE.org Record: CVE-2026-35002](https://www.cve.org/CVERecord?id=CVE-2026-35002)\n- [GitHub Security Advisory: GHSA-77rh-m34w-rv36](https://github.com/advisories/GHSA-77rh-m34w-rv36)\n- [Agno GitHub Repository](https://github.com/agno-agi/agno)\n- [CVE List V5 JSON Record for CVE-2026-35002](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35002.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-35002) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/751d3cd21b1c9dd5ca482d371cb23ebc"}, {"timestamp": "2026-10-27T15:50:04.751Z", "date_only": false, "value": "2026-10-27T15:50:04.751709Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myulna6jo32p", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "951ea6db-c4f1-4b26-9c1e-d4c58ba8c4af", "content": "CVE-2026-35002 - agno\nVersions of Agno before 2.3.24 let a specially crafted input control a function that runs arbitrary code, so an attacker could take over the application. This affects any Agno\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#agno #agnoteam #pip #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myulna6jo32p"}], "metrics": {"as_of": "2026-10-30T23:52:54.670Z", "anchors": {"origin": {"timestamp": "2026-04-02T14:34:14.538Z", "date_only": false, "value": "2026-04-02T14:34:14.538Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-04-02T14:34:14.538Z", "date_only": false, "value": "2026-04-02T14:34:14.538Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-04-02T17:38:06Z", "date_only": false, "value": "2026-04-02T17:38:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwam_g57gd_s1UAnW3xco8kE", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "395320c7-b61d-4d14-a933-b68b748ff662", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 11031.462, "hours": 3.064295, "days": 0.12767895833333331, "min_seconds": 11031.462, "max_seconds": 11031.462, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T14:34:14.538Z", "date_only": false, "value": "2026-04-02T14:34:14.538Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-04-02T17:38:06Z", "date_only": false, "value": "2026-04-02T17:38:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwam_g57gd_s1UAnW3xco8kE", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "395320c7-b61d-4d14-a933-b68b748ff662", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 18263920.132819, "hours": 5073.311148005278, "days": 211.3879645002199, "min_seconds": 18263920.132819, "max_seconds": 18263920.132819, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T14:34:14.538Z", "date_only": false, "value": "2026-04-02T14:34:14.538Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-35002", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T23:52:54.670Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 18252888.670819, "hours": 5070.246853005277, "days": 211.26028554188656, "min_seconds": 18252888.670819, "max_seconds": 18252888.670819, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-04-02T17:38:06Z", "date_only": false, "value": "2026-04-02T17:38:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/MQ6ai6F8nIsMgggTBJXuPSpPwam_g57gd_s1UAnW3xco8kE", "record": "CVE-2026-35002", "field": "creation_timestamp", "uuid": "395320c7-b61d-4d14-a933-b68b748ff662", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-30T23:52:54.670Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}