https://vulnerability.circl.lu/sightings/feed 2026-09-27T04:26:34.211062+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4477b6d5-69b7-4737-9bdd-2fe661ec9d23/export 2026-09-27T04:26:34.239226+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4477b6d5-69b7-4737-9bdd-2fe661ec9d23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51856", "type": "seen", "source": "https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7", "content": "# CVE-2026-51856\n\n**Type:** Incorrect Access Control\n**Product:** AgentScope\n**Affected versions:** 1.0.18\u20131.0.19\n**Affected component:** `src/agentscope/agent/_realtime_agent.py:RealtimeAgent._acting,\nsrc/agentscope/tool/_toolkit.py:Toolkit.call_tool_function,\nsrc/agentscope/tool/_coding/_python.py:execute_python_code`\n**Reference:** https://github.com/agentscope-ai/agentscope/issues/1563\n\n## Description\n\nIn agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.\n\n## Discoverer\n\nRo1ME\n", "creation_timestamp": "2026-09-26T04:01:57.000000Z"} 2026-09-26T04:01:57+00:00