CVE-2026-18974

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. It affects the function get_file_content in the file server.py of the execute_tool_manually Endpoint. Manipulation of the tool_name/tool_params arguments results in information disclosure. The attack can be launched remotely, and the exploit has been made public.

Risk Assessment

Information disclosure may allow an attacker to access sensitive data, potentially leading to confidentiality breaches.

Recommendation

Apply the patch or update to the latest version. Restrict access to the endpoint to trusted users only.

Other vulnerabilities in super-agent-party

CVE-2026-18973High
A vulnerability was found in heshengtao super-agent-party up to 0.4.1, affecting the function sanitize_proxy_url in the file server.py in the extension_proxy Route component. Manipulation of the url argument leads to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.