CVE-2026-51922

CVSS 9.8 (critical) · published 2026-10-02

agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

Weakness: CWE-94

Source: NVD CVE-2026-51922

References

• https://gist.github.com/Ro1ME/78910899a99e2ba702d588e477d0755f
• https://github.com/agentscope-ai/agentscope/issues/1645
• https://github.com/agentscope-ai/agentscope/issues/1645

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.