AgentScope EUVD-2026-90424

Exploitation requires that the agentscope RealtimeAgent session is configured to expose execute_python_code as an available tool AND that the agent is reachable by the attacker over its WebSocket interface; on that path RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function with no approval prompt or sandbox/isolation boundary. The primary limiting factor is that the code-execution tool must be registered/enabled for the session - an instance that does not expose execute_python_code is not vulnerable via this path - and the WebSocket endpoint must be network-accessible to the attacker. Affected versions are agentscope 1.0.18 and 1.0.19.

The signals are mixed but lean toward genuine priority in affected deployments. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity code execution with total impact, and SSVC corroborates this with Technical Impact: total and Automatable: yes. SSVC Exploitation status is 'poc' and a public exploit gist exists, so this is publicly available exploit code - NOT confirmed active exploitation (no CISA KEV listing). The EPSS score is low at 0.20% (9th percentile), which conflicts with the 9.8 CVSS; this gap is explained by the fact that exploitation is gated on a specific deployment choice - the RealtimeAgent session must expose execute_python_code as an available tool - so the broad-internet exploitation probability that EPSS models is genuinely low even though impact on an exposed instance is catastrophic. Net: a real priority for anyone running agentscope 1.0.18/1.0.19 with a WebSocket-exposed RealtimeAgent that offers code execution, but not an indiscriminate internet-wide threat. Note also that the CVSS vector reports PR:N while the description makes clear exploitation requires the operator to have enabled the code-execution tool - verify the deployed configuration before treating as unconditionally unauthenticated.

An operator deploys an agentscope RealtimeAgent over WebSocket with execute_python_code registered as an available tool. A remote user connects and sends a prompt that steers the model into issuing a tool call to execute_python_code; RealtimeAgent._acting forwards it to Toolkit.call_tool_function, which runs the attacker-chosen Python in the service environment with no approval or isolation boundary. A public proof-of-concept exploit gist is available, and given AV:N/AC:L the interaction is simple to reproduce against an exposed instance.