CVE-2026-51922: AgentScope v1.0.20 RCE Vulnerability

CVE-2026-51922 Overview

CVE-2026-51922 is a code injection vulnerability in agentscope v1.0.20, an open-source multi-agent framework. The flaw resides in the execute_shell_command function located in src/agentscope/tool/_coding/_shell.py. Attackers can trigger execution of attacker-controlled code or shell commands when the vulnerable entry point is exposed. The weakness is classified as [CWE-94] Improper Control of Generation of Code. Because the attack vector is network-based and requires no authentication or user interaction, any application that exposes the shell tool to untrusted input is at risk of full host compromise.

Critical Impact

Unauthenticated remote attackers can execute arbitrary shell commands on hosts running agentscope v1.0.20, leading to complete compromise of confidentiality, integrity, and availability.

Affected Products

• agentscope v1.0.20
• Applications embedding the execute_shell_command tool from agentscope.tool._coding._shell
• Agent deployments that expose the shell tool to network-reachable inputs

Discovery Timeline

• 2026-10-02 - CVE-2026-51922 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-51922

Vulnerability Analysis

The vulnerability exists in agentscope's shell execution tool, which is intended to let agents run shell commands as part of coding workflows. The execute_shell_command function in src/agentscope/tool/_coding/_shell.py passes attacker-influenced input to a shell interpreter without adequate sandboxing or validation. When an agent entry point surfaces this tool to external users (for example, through a chat interface or an API endpoint), prompt or request content can steer the agent to invoke the tool with hostile arguments. The result is arbitrary command execution under the privileges of the agentscope process.

Frameworks like agentscope commonly run on servers with access to credentials, source code, and internal network segments. A successful exploit therefore extends beyond a single process and provides a foothold for lateral movement, data theft, or persistence.

Root Cause

The root cause is improper control of generation of code [CWE-94]. The shell tool trusts command strings constructed from upstream agent reasoning and does not enforce an allowlist, argument escaping, or isolation boundary. Any path that reaches execute_shell_command with untrusted content becomes a command injection sink.

Attack Vector

Exploitation requires network access to an application that exposes the agentscope shell tool. An attacker submits crafted input that the agent forwards to execute_shell_command, embedding shell metacharacters or chained commands. No credentials or user interaction are required, and the attack succeeds whenever the tool is reachable from an untrusted channel.

A proof-of-concept script and discussion are available in the GitHub Gist PoC and the agentscope issue #1645.

Detection Methods for CVE-2026-51922

Indicators of Compromise

• Unexpected child processes spawned by the Python interpreter running agentscope, especially shells such as /bin/sh, /bin/bash, or cmd.exe.
• Outbound network connections from the agentscope host to attacker-controlled infrastructure shortly after agent prompts.
• New or modified files in agent working directories, cron entries, or SSH authorized_keys on the host.

Detection Strategies

• Monitor process lineage for execute_shell_command invocations that produce shells, network utilities (curl, wget, nc), or interpreters (python, perl).
• Inspect agentscope application logs for tool calls containing shell metacharacters such as ;, |, &&, backticks, or $().
• Correlate inbound API or chat traffic with subsequent shell activity on the agent host.

Monitoring Recommendations

• Enable command-line auditing (Linux auditd execve rules or Windows Sysmon Event ID 1) on hosts running agentscope.
• Forward process, network, and application telemetry to a centralized analytics platform for behavioral correlation.
• Alert on first-seen binaries executed under the agentscope service account.

How to Mitigate CVE-2026-51922

Immediate Actions Required

• Inventory all deployments of agentscope and identify instances running v1.0.20 or exposing execute_shell_command to untrusted input.
• Restrict network exposure of agent endpoints to trusted users and internal networks only.
• Disable or remove the shell tool from agent toolkits where command execution is not required.

Patch Information

No vendor-published patch is referenced in the NVD entry at the time of writing. Monitor the agentscope issue tracker for an upstream fix and upgrade as soon as a patched release is available.

Workarounds

• Remove execute_shell_command from the agent's registered tool list until a patched version is released.
• Run agentscope inside a hardened container or sandbox with no network egress, minimal filesystem access, and a non-privileged user.
• Place a strict input validation and allowlist layer between external users and any agent capable of invoking shell tools.

# Example: run agentscope in a restricted container with no outbound network
docker run --rm \
  --network none \
  --read-only \
  --cap-drop ALL \
  --user 10001:10001 \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  agentscope:patched