Executive Summary

This vulnerability exists in modelscope agentscope up to version 1.0.18, specifically in the functions execute_python_code and execute_shell_command within the file src/AgentScope/tool/_coding/_python.py.

It allows an attacker to perform code injection, meaning malicious code can be executed remotely on the affected system.

The vulnerability has been publicly disclosed and the vendor did not respond to early contact attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote attacker to inject and execute arbitrary code on the affected system.

Such an attack could lead to unauthorized control over the system, data compromise, disruption of services, or further exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server, leading to full compromise of the server environment.

This includes exposure and theft of sensitive environment variables such as API keys and tokens, which could contain personal or confidential data.

Such unauthorized access and potential data exfiltration can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and ensuring system integrity.

Therefore, this vulnerability poses a significant risk to compliance with common standards and regulations by enabling data breaches and loss of control over protected data.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-6603 involves monitoring for unauthorized execution of Python code or shell commands triggered remotely via the AgentScope LLM agents. Since the vulnerability allows remote code execution through HTTP endpoints, inspecting HTTP POST requests to endpoints like /chat for suspicious payloads is critical.

You can look for evidence of exploitation by checking for unexpected files created by attacker-supplied code, such as /tmp/agentscope_rce_pwned or /tmp/agentscope_env_leak.

Suggested commands to detect signs of exploitation or suspicious activity include:

• Monitor HTTP POST requests to the /chat endpoint for suspicious payloads using tools like tcpdump or Wireshark.
• Check for unexpected files created by attacker code: `ls -l /tmp/agentscope_rce_pwned /tmp/agentscope_env_leak`
• Search process logs or running processes for unexpected Python or shell commands spawned by the AgentScope process.
• Use system auditing tools (e.g., auditd) to track execution of subprocesses launched by the AgentScope service.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps for CVE-2026-6603 include:

• Disable or restrict access to the vulnerable AgentScope LLM agents, especially any HTTP endpoints like /chat that allow remote interaction.
• Implement network-level controls such as firewall rules to block external access to the vulnerable services.
• Avoid deploying or running AgentScope versions up to 1.0.18 until a patch or secure update is available.
• Monitor your systems for signs of compromise, including unexpected file creation or unusual subprocess executions.
• Consider isolating the AgentScope service in a restricted environment with minimal privileges and no access to sensitive environment variables.

Useful 0 Not Useful 0