External risk intelligence

AgentScope Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51922

AgentScope is a framework for developing multi-agent applications. While the vulnerable code execution function could be exposed if a developer builds an internet-facing service using this library, the framework itself is typically used as a development or backend orchestration tool rather than a public-facing edge service or gateway.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A code injection vulnerability has been identified in the `agentscope` framework, a tool used for developing multi-agent applications. This issue could allow an attacker to execute unauthorized code or commands if certain entry points within the application are exposed. The main concern is to confirm if this technology is in use and if any internet-facing services could be affected.

Code can be injected into the framework.
Vulnerability could impact applications built with it.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability if they can find a way to interact with the `execute_shell_command` function within the Agentscope library. This could potentially happen if a developer exposes this functionality in a way that is accessible over a network. If successful, the attacker could then execute their own code or commands on the system.

Network-accessible code execution.
Unauthenticated remote code injection.
High impact on confidentiality, integrity, availability.

Live Threat

Current exploitation, exposure, and threat context

The `execute_shell_command` function in AgentScope could allow an attacker to run their own code or commands. This could happen if a developer exposes this function through a network-accessible service.

Remote code execution.
Triggered via network interface.
Compromised system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The agent responsible for AgentScope, likely an application or platform team, must first identify all instances of the affected technology. Once located, these teams should determine if the vulnerable components are exposed externally or are critical business assets before engaging with vendor management or development teams to plan remediation within appropriate maintenance windows.

Application or platform teams own the issue.
Verify external exposure and business criticality.
Plan remediation based on risk and vendor input.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AgentScope?

AgentScope is a development framework designed to help engineers build and orchestrate multi-agent applications. It provides various utilities to manage agent interactions and backend tasks. Because it focuses on the logic and coordination of AI agents rather than serving as a web gateway, it is typically used as an internal library within development environments or backend systems.

What does CVE-2026-51922 mean?

This CVE identifies a code injection vulnerability, specifically categorized as CWE-94. It indicates that the application fails to properly validate input before passing it to a shell command execution function. In plain terms, if an attacker can send specific instructions to the vulnerable part of the software, the system may mistakenly interpret that input as legitimate commands and execute them on the underlying host.

How can an attacker trigger this vulnerability?

The vulnerability is triggered when an attacker interacts with the vulnerable execute_shell_command function through an exposed network path. It does not trigger if the function remains isolated from external input or if the application does not provide a way for untrusted users to reach that specific code path. It requires the developer to have inadvertently bridged the library's internal functions to an accessible entry point.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the risk is categorized as external due to the network-based nature of the flaw, AgentScope is generally not a public-facing service. Your actual risk depends on whether your developers have built a custom service using this framework that accepts and processes input from the open internet, rather than using it solely for internal backend orchestration.

Do I need to act immediately for this vulnerability?

Your first step is to locate all instances of AgentScope within your infrastructure to see where it is deployed. Once identified, evaluate whether the specific applications using this library are connected to the internet or handle untrusted user input. If you confirm that a system is exposed, work with your development or platform team to review the implementation and plan remediation in your next maintenance cycle.

References

github.com/agentscope-ai/agentscope/issues/1645

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.