Summary
A code injection vulnerability in AgentScope's RealtimeAgent can allow a remote WebSocket user to cause the agent to invoke the exposed execute_python_code tool. When that tool is available without an additional approval or isolation boundary, attacker-controlled Python code may run in the service environment.
Affected context
The vulnerability occurs in RealtimeAgent sessions where execute_python_code is exposed as an available tool. A remote WebSocket participant may be able to influence model-directed tool calls, and the validated execution path forwards those calls to Toolkit.call_tool_function without a separate authorization, approval, or sandbox boundary. Risk depends on whether the service exposes this tool and what permissions the hosting environment grants to the process.
Exploit preconditions
- Attack surface: RealtimeAgent WebSocket session
- Required access: Ability to connect to or interact with a session that exposes the vulnerable tool
- Trigger point: A model-produced tool call forwarded through
RealtimeAgent._acting - Required capability:
execute_python_codemust be registered and available to the agent - Why exploitation is possible: Tool invocation reaches Python execution without an additional approval gate or effective isolation boundary
Why this happens
The underlying issue is insufficient control over a tool that evaluates and executes Python code. The RealtimeAgent execution path treats a model-produced request as sufficient authorization to call execute_python_code, rather than separating model intent from privileged execution. This maps to CWE-94: Improper Control of Generation of Code, because externally influenced input can cause executable code to be generated or run without adequate restrictions.
Potential impact
- An attacker may execute arbitrary Python code in the service environment
- The process may access application data, credentials, or local resources permitted by its identity
- Service integrity or availability could be affected
- The compromised service could be used for lateral movement or further attacks
- Sensitive information may be exposed or modified
General mitigation guidance
Mitigation generally focuses on reducing trust in model-directed tool calls and preventing unrestricted code execution.
Common defensive patterns include:
- Avoiding exposure of general-purpose Python execution tools in remotely accessible sessions
- Replacing unrestricted execution with narrowly scoped, allowlisted operations
- Requiring explicit user or service authorization before invoking sensitive tools
- Applying strong sandboxing, resource limits, and filesystem and network restrictions
- Running the service with least privilege and isolated credentials
- Treating WebSocket participants and model output as untrusted input
- Enforcing tool registration and authorization policies independently of model decisions
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving dynamic execution functions or general-purpose code tools
- Code paths where model-generated tool calls directly invoke privileged functions
- Registrations of
execute_python_codeor similar tools in externally reachable agent sessions - Missing approval, authorization, sandbox, timeout, or resource-limit checks around tool dispatch
- Policy checks that prohibit unrestricted code execution in network-facing services
- Runtime telemetry recording WebSocket identities, tool selection, execution requests, and denied approvals
Automated code review and policy enforcement tools may help identify newly exposed execution capabilities.
