CVE-2026-51856
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In agentscope 1.0.18, 1.0.19, and 1.0.19, when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.
Risk Assessment
A remote attacker can force execution of arbitrary Python code in the service environment, potentially leading to system takeover or data leakage. The lack of isolation and approval significantly increases the risk.
Recommendation
Upgrade agentscope to a version containing the fix and restrict exposure of the execute_python_code tool in RealtimeAgent sessions. Introduce approval and isolation mechanisms for tool calls.
Other vulnerabilities in agentscope
See all- CVE-2026-51922Critical
AgentScope v1.0.20 contains a code injection vulnerability in the execute_shell_command function in src/agentscope/tool/_coding/_shell.py. Depending on the exposed entry point, an attacker can trigger attacker-controlled code or command execution.
- CVE-2026-85685High
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Original NVD description (English source)
In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS