AgentScope: Path traversal in write_text_file
Summary
AgentScope, a Python agent framework from ModelScope, contains a path traversal vulnerability (CWE-22) in its write_text_file tool. An attacker who can influence the file path passed to this function can write files outside the intended workspace or storage boundary. According to the CVSS vector, exploitation is possible over the network with low privileges and no user interaction, and it impacts confidentiality and integrity. The risk is mainly relevant where agents, APIs or workflows pass untrusted input to this tool.
Affected
- AgentScope versions reported as 1.0.0 to 1.0.18 (NVD text: v1.0.18-v1.0.0).
- The GitHub gist reports 1.0.18 to 1.0.19.post1. The exact range is unconfirmed.
- Affected component: write_text_file in src/agentscope/tool/_text_file/_write_text_file.py.
Fixed in
Unknown. No vendor advisory or confirmed fixed release was found. A pull request addressing path traversal in write_text_file exists, but its merge status and release are unconfirmed.
Workaround
- Do not pass untrusted input to agents or workflows that use write_text_file.
- Canonicalise paths and verify they stay inside an allowed directory before writing.
- Run AgentScope with least-privilege OS accounts, ideally in containers, and restrict write access to the working directory.
Exploitation
- CISA SSVC: exploitation status poc, automatable: no, technical impact: partial.
- No evidence of exploitation in the wild was found.
- A third-party gist is listed as a reference; its content was not verified as a proof of concept.
Our recommendation
- Inventory systems running AgentScope and identify agents that expose write_text_file to user-controlled input.
- Restrict or disable file-writing tools for untrusted input until a fixed version is confirmed.
- Update to a fixed AgentScope release once the vendor publishes one and verify the version.
- Monitor file-write activity outside the expected workspace.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51568 gist (Ro1ME) gist.github.com
- AgentScope issue #1508 github.com
- VulDB CVE-2026-51568 vuldb.com
- CodeAnt vulnerability summary CVE-2026-51568 codeant.ai
- AgentScope pull requests github.com
- AgentScope issue #3179 (related permission path normalisation) github.com
- TheHackerWire CVE-2026-51568 www.thehackerwire.com
- Strix CVE-2026-51568 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:05.
Original description (NVD)
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.