Is there a public PoC exploit available for CVE-2026-6603?

Yes, a public proof-of-concept exploit is available for CVE-2026-6603. Prioritise patching immediately. EPSS: 0.0%.

Agentscope CVE-2026-6603

Q: What is the CVSS score of CVE-2026-6603?

CVE-2026-6603 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23770 MEDIUM

Code Injection (CWE-94)

2026-04-20 VulDB

GHSA-cr24-fv3h-8cjm

Code Injection RCE Agentscope

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 20, 2026 - 05:26 vuln.today

Severity Changed

Apr 20, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Apr 20, 2026 - 05:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Apr 20, 2026 - 05:15 euvd

EUVD-2026-23770

Analysis Generated

Apr 20, 2026 - 05:15 vuln.today

CVE Published

Apr 20, 2026 - 04:00 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 pypi packages depend on agentscope (6 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.0.18.

DescriptionCVE.org

A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command of the file src/AgentScope/tool/_coding/_python.py. This manipulation causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject and execute arbitrary Python code or shell commands through the execute_python_code and execute_shell_command functions in src/AgentScope/tool/_coding/_python.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications, leaving all versions up to 1.0.18 unpatched and actively exploitable.

Technical ContextAI

AgentScope is a multi-agent framework built on ModelScope. The vulnerability exists in the code execution utilities within the _coding module, which are designed to safely execute Python and shell commands as part of agent tool operations. The root cause is CWE-94 (Improper Control of Generation of Code), indicating that user-supplied input is not properly sanitized before being passed to Python code evaluation or shell command execution functions. The affected component processes code execution requests without adequate input validation or sandboxing, allowing attackers to inject arbitrary code that will be executed with the privileges of the AgentScope process. CPE indicates all versions of ModelScope AgentScope are affected, with known vulnerable versions through 1.0.18.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor has not responded to disclosure and no patched version is publicly available. Organizations running AgentScope should immediately discontinue use of versions up to 1.0.18 until a security patch is released. If continuation is unavoidable, implement compensating controls: (1) restrict network access to AgentScope services using firewall rules - allow only trusted internal subnets to reach the agent execution endpoints, which trades off distributed deployment flexibility for containment; (2) disable or remove the execute_python_code and execute_shell_command tools from agent toolsets if they are not critical to operations, eliminating the attack surface entirely; (3) run AgentScope within a containerized environment (Docker/Kubernetes) with restrictive seccomp profiles and disabled system calls (e.g., exec, fork) to limit code execution impact, though this may break legitimate agent functionality. Monitor the official ModelScope repository (https://github.com/modelscope/agentscope) and VulDB (https://vuldb.com/vuln/358238) for patch availability. Vendors and users should contact ModelScope directly through GitHub issues or security contact if available.