CVE-2026-51856

9.8 CRITICALpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI risk analysis

Summary: The flaw allows a remote user to execute arbitrary Python code on the server, leading to Remote Code Execution (RCE). This is critical because it can enable full control over the server's functionality and data.
Exploitability: Exploitation is relatively straightforward as it requires a WebSocket connection to the RealtimeAgent. The user must have access to the WebSocket endpoint.
Blast radius: If exploited, the impact could be severe, potentially leading to data theft, service disruption, or complete server compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable the RealtimeAgent feature that exposes execute_python_code or upgrade to a version that addresses this vulnerability, such as agentscope 2.0.0 or later.

rcepythonwebsocketscode-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.