AgentScope CVE-2026-51568

Requires a deployed AgentScope agent (v1.0.0 through v1.0.18) that exposes or invokes the write_text_file tool/function, where an attacker can influence the file path argument - most realistically through untrusted content processed by the agent (indirect prompt injection) or a malicious task submitted to the agent. Limiting factors: the affected framework has a narrow deployment base; exploitation depends on the agent actually being wired to call write_text_file with attacker-influenceable paths; the CVSS assigns PR:L (some level of access to the agent), though a prompt-injection path could reduce this to effectively unauthenticated depending on how the agent ingests external input.

CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), driven by a network vector, low complexity, and only low privileges required. However, the raw score overstates real-world urgency for several reasons. AgentScope is a niche open-source multi-agent LLM framework, not broadly deployed enterprise infrastructure, so the exposed population is small. No EPSS score, no CISA KEV listing, and no SSVC decision data are provided, so there is no evidence of active or automatable exploitation. A public gist (Ro1ME) is referenced alongside the upstream issue, strongly implying proof-of-concept code exists, which raises the practical likelihood of opportunistic exploitation against exposed agent deployments. The vendor-assigned C:H is questionable for what is fundamentally an arbitrary file-WRITE primitive (write_text_file) - path traversal on a write path typically yields integrity impact, not direct confidentiality disclosure; verify the confidentiality rating with the vendor/reporter. Also note the PR:L rating conflicts with the most realistic exploitation model (indirect prompt injection through untrusted agent input), which would make it effectively unauthenticated in many deployments - this is a data conflict worth resolving before prioritization. Net: a real but bounded issue - moderate priority, elevated by likely POC availability but tempered by low deployment footprint and absence of active-exploitation signals.

An attacker submits crafted input (e.g., via indirect prompt injection or a malicious task) to an AgentScope-based agent that exposes the write_text_file tool. The agent invokes write_text_file with an attacker-influenced path containing traversal sequences (../../), causing text to be written outside the intended output directory - overwriting configuration, source, or startup files and potentially chaining to code execution. A public gist appears to demonstrate the technique, so working exploit code likely exists.