It appears that Agentscope 1.0.18 and 1.0.19 contain a flaw in the RealtimeAgent._acting method, which forwards model‑generated tool calls directly to the execute_python_code function without any additional approval or isolation. This flaw allows a user who can connect to the agent via WebSocket to instruct the agent to run arbitrary Python code in the service environment, effectively granting remote code execution. By its nature, the flaw exploits the lack of an approval boundary, so it is inferred that any tool call triggered by the model can be executed. The resulting impact could include full control over the host, persistence, data exfiltration, and lateral movement.

The vulnerability affects the open‑source Agentscope project, specifically releases 1.0.18 and 1.0.19. No vendor patch is listed, and the issue is tracked on the project's GitHub issue tracker and community gist. Users running those versions and exposing the execute_python_code tool in a WebSocket session are at risk. It is inferred that the environment in which Agentscope runs may be a production service where the agent is exposed over WebSocket.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is < 1%, suggesting a relatively low but nonzero probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Because the flaw allows direct execution of arbitrary code once a WebSocket connection exists, the risk posture remains high. The attack path requires only the ability to send a tool‑call message via WebSocket, so any user with network access to the service can trigger exploitation. The lack of authentication beyond the WebSocket level implies that the vulnerability is readily exploitable in scenarios where the WebSocket is exposed to untrusted clients.