A vulnerability exists in the execute_python_code and execute_shell_command functions of modelscope agentscope (source file src/AgentScope/tool/_coding/_python.py) that allows code injection via unsafe handling of user‑supplied input. The flaw, identified as CWE‑74 and CWE‑94, enables an attacker to inject arbitrary shell commands, effectively leading to remote code execution. The CVSS score of 6.9 reflects the severity of this remote exploitation risk. The vulnerability is not listed in the CISA KEV catalog and no EPSS value is available, yet it has been publicly disclosed, making it available to potential attackers.

The affected product is modelscope agentscope up to version 1.0.18. Vendors and product details from the CNA indicate that any deployment of agentscope below version 1.0.19 is vulnerable; the specific versions in the supply chain are not enumerated beyond this upper bound.

The vulnerability can be exploited remotely through any interface that triggers the execute_shell_command function. No authentication or preprocessing is performed before command execution, so an attacker with network access can inject command payloads. Because the code runs with the privileges of the agent process, successful exploitation can compromise the entire host. The absence of an EPSS score leaves the actual exploitation probability uncertain, but the public disclosure and remote nature suggest a non‑negligible risk.