Remote Code Execution in agentscope RealtimeAgent

Executive Summary

In agentscope versions 1.0.18, 1.0.19, and 1.0.19, a vulnerability exists where a remote WebSocket user can exploit the RealtimeAgent session to run arbitrary Python code. This occurs because the execute_python_code tool is exposed as an available function, and the RealtimeAgent._acting method forwards tool calls to Toolkit.call_tool_function without proper approval or isolation, allowing code execution in the service environment.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if agentscope 1.0.18, 1.0.19, or 1.0.19 is running and if RealtimeAgent exposes execute_python_code as a tool. Inspect network traffic for WebSocket connections to the agent service. Look for unexpected Python code execution attempts or unauthorized tool calls.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary Python code on the affected system remotely. This could lead to unauthorized access, data theft, system compromise, or disruption of service. If the service runs with elevated privileges, the impact could be severe, including full system takeover or lateral movement within a network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized code execution and potential data breaches. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade agentscope to a patched version where execute_python_code is not exposed as a tool or requires additional approval. Disable the RealtimeAgent session's ability to call execute_python_code remotely. Review and restrict WebSocket user permissions to prevent unauthorized tool invocation.

Useful 0 Not Useful 0