Agno PandasTools let a model-selectable function reach unsafe pickle loading

Agno’s create_pandas_dataframe tool accepted a create_using_function name and dispatched it through getattr on the pandas module. The code checked the returned object’s type only after invoking the selected function, so a dangerous call such as read_pickle could already have performed unsafe deserialization. The relevant attacker route is influencing the tool’s function name and arguments, not merely mentioning a pickle file in an unrelated prompt.

The reported affected series includes 3.1.11, while a fixed package version was not established in the evidence available here. The finding does not document a confirmed real-world victim or a universally exposed HTTP entry point. The proper regression test is to restrict the available constructors before dispatch and verify that malicious or unsupported function names never invoke pandas in the first place.