CVE-2026-18974

Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2

Description A remote information disclosure issue exists within the execute tool manually endpoint. The flaw is located in the get file content() function of the server.py file. An attacker can trigger this by manipulating the tool name and tool params variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the execute tool manually endpoint or avoid using the tool name and tool params variables within the get file content() function.