A vulnerability was found in modelscope agentscope up to 1.0.18. It has been classified as critical. Affected by this vulnerability is the function
execute_python_code/execute_shell_command of the file src/AgentScope/tool/_coding/_python.py. This manipulation causes code injection.
This vulnerability is tracked as CVE-2026-6603. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
