AgentScope EUVD-2026-91754

Exploitation requires the host application to expose agentscope's execute_shell_command tool to attacker-influenced input - the description's 'Depending on the exposed entry' means the shell tool must be reachable via an agent that acts on untrusted prompts, an exposed API, or similar routing of external data into the command. The key limiting factor is this deployment choice: agentscope installations that never expose the shell tool to untrusted input, or that gate it behind authentication/human approval, are not exploitable despite the library being present. No user interaction is required once untrusted input reaches the tool, and no special platform is needed beyond running agentscope v1.0.20 with the vulnerable code path exposed.

Signals conflict and should be weighed carefully. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) describes a worst-case unauthenticated remote code-execution scenario, and CWE-94 (code injection) in a shell-execution helper is inherently severe. However, the description explicitly qualifies this with 'Depending on the exposed entry,' meaning exploitability is contingent on whether the host application wires execute_shell_command to attacker-reachable input - so the clean AV:N/PR:N characterization likely overstates the default-configuration risk. The EPSS score is low (0.27%, 17th percentile), indicating no modeled trend toward widespread opportunistic exploitation, and the CVE is NOT in CISA KEV (no confirmed active exploitation). A researcher gist is linked, which typically indicates public proof-of-concept material, but no explicit POC flag is provided in the input, so this should be treated as probable rather than confirmed. Net: this is a genuinely high-impact code-injection flaw whose real-world priority is strongly deployment-dependent rather than a mass-exploitation emergency - elevate it where agentscope's shell tool is exposed to untrusted/LLM-routed input, and down-rank it where the tool is only invoked internally. Note: the input CPE string 'cpe:2.3:a:n/a:n/a' is a placeholder and provides no reliable affected-product bounds - verify versions against the GitHub issue.

An application built on agentscope v1.0.20 exposes the execute_shell_command tool to externally influenced input (for example, an LLM agent that acts on untrusted user prompts or an API endpoint). An attacker submits crafted input containing shell/code-injection syntax; because the command string is not safely sanitized, the attacker's commands execute on the host with the process's privileges. A public gist linked in the references appears to document proof-of-concept exploitation of this path.