EUVD-2026-53695
GHSA-fvhg-m33v-6wqx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no authentication (PR:N), low complexity; confidentiality impact only (C:L), no integrity or availability loss, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated remote information disclosure in heshengtao super-agent-party (up to version 0.4.1) allows remote attackers to read sensitive file content by manipulating the tool_name or tool_params arguments passed to the get_file_content function via the execute_tool_manually endpoint in server.py. The flaw requires no authentication and no user interaction, and a public proof-of-concept exploit is available on GitHub. No patch has been issued; the vendor did not respond to coordinated disclosure.
Technical ContextAI
super-agent-party is an AI agent orchestration framework (CPE: cpe:2.3:a:heshengtao:super-agent-party:*:*:*:*:*:*:*:*) built around a Python server (server.py). The framework exposes an execute_tool_manually HTTP endpoint that accepts tool_name and tool_params inputs to invoke internal tool handlers programmatically. The get_file_content function within this endpoint processes these parameters without sufficient input validation or authorization gating, allowing an attacker to influence which file is read and returned. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw where server-side data - potentially including configuration files, secrets, or internal application data - is surfaced to callers who should not have access. The attack vector suggests inadequate parameter sanitization rather than a cryptographic or access-control enforcement failure.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure attempts. As a primary compensating control, operators should restrict network access to the execute_tool_manually endpoint via firewall rules or reverse-proxy ACLs so that only trusted internal clients can reach it - note this does not fix the underlying flaw but prevents remote exploitation. If the endpoint is not required for production use, disabling or removing it from the server.py routing configuration eliminates the attack surface entirely; the trade-off is loss of manual tool invocation capability. Applying runtime application firewall (WAF) rules to reject requests with path traversal patterns (e.g., ../, absolute paths) in tool_name or tool_params parameters may reduce exploitation success but is not a guaranteed control given the flexibility of the parameter space. Organizations should monitor the VulDB entry (https://vuldb.com/vuln/386263) and the project repository for any upstream patches issued after this analysis date.
More in Super Agent Party
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today