CVE-2026-51856

Remote code execution via RealtimeAgent execute_python_code tool exposure.

• CWE-94 (inferred)
• Authentication, Authorization, and Session Management
• Remote

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

CVE

CVE-2026-51856

CWE

CWE-94 (inferred)

Published

2026-09-30

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

agentscope

Fixed by upgrading

Yes

Solution

Upgrade to agentscope ≥ 1.0.20, which removes the exposed execute_python_code tool from RealtimeAgent and adds proper isolation/approval checks.

import json
from agentscope.toolkit import Toolkit

class RealtimeAgent:
    def __init__(self, toolkit: Toolkit):
        self.toolkit = toolkit

    def _acting(self, model_output: str):
        """Parse model output and invoke requested tool."""
        call = json.loads(model_output)  # {"tool":"execute_python_code","args":{"code":"print(1)"}}
        tool_name = call["tool"]
        args = call["args"]
        # VULNERABLE: direct execution of arbitrary Python code
        return self.toolkit.call_tool_function(tool_name, **args)

    def receive_message(self, ws_message: str):
        """Entry point for a WebSocket message."""
        return self._acting(ws_message)

import json
from agentscope.toolkit import Toolkit

class RealtimeAgent:
    def __init__(self, toolkit: Toolkit):
        self.toolkit = toolkit

    def _acting(self, model_output: str):
        """Parse model output and invoke requested tool."""
        call = json.loads(model_output)  # {"tool":"execute_python_code","args":{"code":"print(1)"}}
        tool_name = call["tool"]
        args = call["args"]
        # FIX: reject unsafe execute_python_code calls unless explicitly approved
        if tool_name == "execute_python_code":
            raise PermissionError("Direct execution of Python code is disallowed")
        return self.toolkit.call_tool_function(tool_name, **args)

    def receive_message(self, ws_message: str):
        """Entry point for a WebSocket message."""
        return self._acting(ws_message)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202651856,
  title        = {{Remote code execution via RealtimeAgent execute_python_code tool exposure.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-51856},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-51856/}}
}