CVE-2026-51856

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

Published 2026-09-30. Last modified 2026-10-01.