AgentScope: Remote code execution via RealtimeAgent tool calls
Summary
In AgentScope 1.0.18 and 1.0.19, a RealtimeAgent session that exposes the execute_python_code tool allows a remote WebSocket user to prompt the agent into running Python code on the service host. The tool call is forwarded without an approval, sandbox or other isolation step. An attacker can then act with the privileges of the AgentScope service, including access to its data, credentials and network. This requires the tool to be exposed in the session and a reachable WebSocket endpoint; whether the endpoint requires authentication is not documented.
Affected
- AgentScope 1.0.18
- AgentScope 1.0.19
- Condition: RealtimeAgent session with execute_python_code registered as an available tool
- The NVD text lists "1.0.18, 1.0.19, and 1.0.19"; the range is assumed to be 1.0.18 and 1.0.19.
Fixed in
Unknown. No vendor advisory or patched version has been confirmed.
Workaround
- Remove execute_python_code from all RealtimeAgent sessions reachable over WebSocket.
- Take the realtime WebSocket endpoint offline until the tool is removed.
- Put the endpoint behind authentication and a reverse proxy, and restrict who can connect.
- Run the service with minimal OS privileges and no access to secrets.
Exploitation
- CISA SSVC assessment: exploitation status "poc", automatable: yes, technical impact: total.
- The researcher's public gist contains reproduction steps.
- No evidence of exploitation in the wild has been reported; a KEV listing could not be verified.
Our recommendation
- Inventory AgentScope 1.0.18 and 1.0.19 deployments and check whether RealtimeAgent is used.
- Remove execute_python_code from realtime sessions now, or disable the endpoint.
- Restrict and authenticate access to the WebSocket endpoint; do not expose it to the internet without protection.
- Check service logs for unexpected tool calls and for files created by the service.
- Track the GitHub issue and the vendor releases for a fixed version and confirm it from the advisory before deploying.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51856 researcher gist gist.github.com
- AgentScope GitHub issue #1563 github.com
- VulDB entry CVE-2026-51856 vuldb.com
- VulnRichment record CVE-2026-51856 vulners.com
- AgentScope releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:45.
Original description (NVD)
In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.