Modelscope CVE-2026-6603

The vulnerability can be exploited against any network-accessible AgentScope instance running version 1.0.18 or earlier where the execute_python_code or execute_shell_command functions are accessible to incoming requests. No special configuration, authentication, or user interaction is required; default deployments are vulnerable if they expose the agent execution endpoints to untrusted networks. Exploitation is limited only by network accessibility - if AgentScope is deployed on an isolated internal network with restricted inbound access, exploitation is hindered by network-layer controls rather than the code itself. The vulnerability does not require any specific platform, though the impact (ability to execute arbitrary code) depends on the privileges and environment (OS, filesystem, network access) of the AgentScope process.

This vulnerability presents HIGH real-world risk despite the CVSS 4.0 score of 6.9. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible, unauthenticated, no-complexity exploitation against default configurations. The E:P tag in the vector indicates proof-of-concept exploitation is available. Most critically, this is a code injection vulnerability (CWE-94) with remote code execution impact, which typically requires only that the vulnerable service is accessible and accepting input - a realistic scenario for agent frameworks deployed in automation or multi-user environments. The CVSS score may be artificially limited due to conservative impact scoring (VC:L/VI:L/VA:L denotes limited confidentiality, integrity, and availability impact in the CVSS 4.0 scope), but actual impact depends on the execution context: if AgentScope runs with elevated privileges or access to sensitive data, impact escalates significantly. The vendor's non-response to early disclosure and the public availability of exploit code removes any uncertainty about exploitability. This is a real priority that should be treated as critical for any production deployment of AgentScope.

An attacker sends a crafted request to an accessible AgentScope instance containing malicious Python code or shell commands embedded in parameters intended for the execute_python_code or execute_shell_command functions. The vulnerable functions process the input without sanitization and execute the injected code, allowing the attacker to read files, install persistence mechanisms, pivot to internal systems, or exfiltrate data. The attack requires only network access and no authentication or user interaction, making it trivial to automate against any publicly or internally exposed AgentScope deployment.