AgentScope: Code injection in execute_shell_command tool
Summary
AgentScope v1.0.20 contains a code injection flaw in the built-in execute_shell_command tool. Command strings generated by the language model are passed unchecked to asyncio.create_subprocess_shell, so an attacker who can influence the agent's tool call, for example through a crafted prompt or prompt-injected content, can run arbitrary commands with the privileges of the agent process. Exploitation depends on whether the tool is registered in the agent and whether the agent is reachable or processes untrusted input.
Affected
- AgentScope v1.0.20 (src/agentscope/tool/_coding/_shell.py)
- Other versions: unknown.
Fixed in
Unknown. No vendor fix has been confirmed.
Workaround
- Remove execute_shell_command from agents that process untrusted input.
- Run agents in an isolated sandbox or container without access to secrets, internal networks or production systems.
- Require authentication for all HTTP, WebSocket or Socket.IO entry points that lead to the agent.
- Monitor for unexpected child processes spawned by the agent service.
Exploitation
- CISA SSVC data lists exploitation as "poc" (public proof of concept) and automatable: yes.
- Public write-ups describe remote code execution via prompt injection; one aggregator reports no public PoC, which conflicts with the SSVC data.
- No CISA KEV listing found.
Our recommendation
- Check whether any AgentScope installation runs version 1.0.20 or another 1.0.x release with execute_shell_command registered.
- Remove the shell tool or isolate the agent immediately if it is internet-facing or processes external content.
- Restrict the agent's operating system account and network access.
- Monitor logs and process activity for unexpected shell commands.
- Watch the upstream issue for a fix and update as soon as one is released.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub issue #1645 github.com
- VulDB CVE-2026-51922 vuldb.com
- OpenCVE CVE-2026-51922 app.opencve.io
- AgentScope GitHub repository github.com
- Strix CVE-2026-51922 www.strix.ai
- EUVD-2026-91754 vulners.com
- TheHackerWire CVE-2026-51922 www.thehackerwire.com
- AgentScope v1.0.20 release notes newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:22.
Original description (NVD)
agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.