AgentScope CVE-2026-85685

No special conditions are required for exploitation against a network-exposed AgentScope server; the vulnerability exists in the default LocalWorkspace.add_skill implementation with no authentication gate per the PR:N CVSS metric. The AgentScope server must be reachable over the network from the attacker's position (default when the server is run without additional network controls). The attacker must be able to send an HTTP request to the add_skill endpoint with an arbitrary skill_path value. Exploitation is limited to directories and files readable by the operating system user running the AgentScope server process - root-owned files with restricted permissions cannot be accessed unless the server runs as root. Deployments where the server is bound exclusively to localhost or protected behind an authenticated reverse proxy are not directly exploitable from remote positions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) establishes a clear high-severity, unauthenticated network-exploitable information disclosure vulnerability with no complexity or interaction barriers. EPSS data is not present in the provided intelligence, and the vulnerability is not listed in CISA KEV at time of analysis, suggesting no confirmed active exploitation. No public exploit code has been identified from available references, though the VulnCheck advisory and a GitHub issue provide sufficient technical detail to construct a proof of concept with minimal effort given the trivial nature of the path traversal. From an SSVC perspective: exploitation is likely automatable (AV:N/AC:L/PR:N), technical impact is partial (confidentiality only, no code execution directly from this bug), but the ease of exploitation elevates operational priority. The primary limiting factor is how widely AgentScope servers are exposed to untrusted networks - in local developer or sandboxed deployments, real-world risk is significantly reduced.

An attacker with network access to an AgentScope server sends an HTTP request to the add_skill endpoint with skill_path set to a sensitive server directory such as /etc/ssh or the application's configuration directory. The server process copies the target directory contents into the workspace skills folder without restriction. The attacker then queries the workspace skill listing API to retrieve the copied files, exfiltrating SSH host keys, application secrets, or other credential material accessible to the server process.