CVE-2026-51856

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In agentscope 1.0.18, 1.0.19, and 1.0.19, when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

Risk Assessment

A remote attacker can force execution of arbitrary Python code in the service environment, potentially leading to system takeover or data leakage. The lack of isolation and approval significantly increases the risk.

Recommendation

Upgrade agentscope to a version containing the fix and restrict exposure of the execute_python_code tool in RealtimeAgent sessions. Introduce approval and isolation mechanisms for tool calls.

Other vulnerabilities in agentscope

CVE-2026-85685High
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.

Original NVD description (English source)

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS