CVE-2026-51856

Name of the Vulnerable Software and Affected Versions agentscope versions 1.0.18 through 1.0.19

Description A remote WebSocket user can prompt the agent to execute arbitrary Python code within the service environment. This occurs when the RealtimeAgent session exposes the execute python code tool. The issue exists because the RealtimeAgent. acting function forwards the model-produced tool call to Toolkit.call tool function, which then invokes execute python code without requiring additional approval or providing an isolation boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, avoid exposing the execute python code tool within RealtimeAgent sessions.