---
title: Agno's PandasTools lets the model pick any pandas function, so a prompt injection can call read_pickle on an attacker file and run code on the agent host (CVE-2026-119050, unpatched) | ctxsec
url: https://ctxsec.com/items/agno-pandastools-cve-2026-119050-prompt-injection-read-pickle-rce
description: ""
status: "official CVE (VulnCheck CNA, Oct 29); issue open since July 2; no fix in releases through 3.1.12 as of Oct 29"
published: 2026-10-29
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/agno-pandastools-cve-2026-119050-prompt-injection-read-pickle-rce.md)

official CVE (VulnCheck CNA, Oct 29); issue open since July 2; no fix in releases through 3.1.12 as of Oct 29

2026-10-29

### Agno's PandasTools lets the model pick any pandas function, so a prompt injection can call read_pickle on an attacker file and run code on the agent host (CVE-2026-119050, unpatched)

The popular agent framework's `PandasTools` runs `getattr(pd, create_using_function)(**function_parameters)` with both values taken from the model's tool call, and only checks that the result is a DataFrame _after_ the call. An agent that reads attacker-influenced text can be steered into `pandas.read_pickle` on a remote or local file (code execution via pickle), or `read_csv`/`read_json` on any local path to leak files back to the model. A second sink, `run_dataframe_operation`, dispatches any DataFrame method the same way, including `query`/`eval` and `to_pickle`. Both tools are on by default. VulnCheck lists Agno through 3.1.11 as affected; the issue was filed July 2 and is still open, and the pandas tool code has not changed in the 3.1.12 release (Oct 29).

**What to do:** if you use PandasTools, disable `enable_create_pandas_dataframe` and `enable_run_dataframe_operation` or wrap them with an allowlist of functions (for example only `read_csv` on a fixed directory), and do not give the tool to agents that read web pages, email, tickets or other untrusted content. The general lesson: a tool that lets the model name the function is a code-execution tool.

Sources: [CVE-2026-119050 (VulnCheck): Agno through 3.1.11 code execution via PandasTools unsafe reflection (Oct 29)](https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection) · [agno-agi/agno issue #8699: PandasTools RCE via model-controlled pandas function selection (read_pickle)](https://github.com/agno-agi/agno/issues/8699) · [CVE-2026-119050 record](https://www.cve.org/CVERecord?id=CVE-2026-119050)