{"id":"CVE-2026-51856","published":"2026-09-30T21:17:11.520","lastModified":"2026-10-01T17:17:25.740","description":"In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","tags":[]},{"url":"https://github.com/agentscope-ai/agentscope/issues/1563","tags":[]},{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","tags":[]},{"url":"https://github.com/agentscope-ai/agentscope/issues/1563","tags":[]},{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows a remote user to execute arbitrary Python code on the server, leading to Remote Code Execution (RCE). This is critical because it can enable full control over the server's functionality and data.","exploitability":"Exploitation is relatively straightforward as it requires a WebSocket connection to the RealtimeAgent. The user must have access to the WebSocket endpoint.","blast_radius":"If exploited, the impact could be severe, potentially leading to data theft, service disruption, or complete server compromise.","remediation":"Disable the RealtimeAgent feature that exposes execute_python_code or upgrade to a version that addresses this vulnerability, such as agentscope 2.0.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","python","websockets","code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:41:27.532Z"}}