Summary
A critical code injection vulnerability in AgentScope's execute_shell_command function may allow attacker-controlled code or operating-system commands to run.
The risk depends on whether an exposed application entry passes attacker-influenced data to this function without adequate authorization, validation, or isolation.
A critical code injection vulnerability in AgentScope's execute_shell_command function may allow attacker-controlled code or operating-system commands to run.
The risk depends on whether an exposed application entry passes attacker-influenced data to this function without adequate authorization, validation, or isolation.
Affected context
The vulnerability occurs in AgentScope v1.0.20 within the shell-command execution component at src/agentscope/tool/_coding/_shell.py. It becomes risky when an externally reachable agent, tool, workflow, or application entry can supply data that reaches execute_shell_command and the execution path does not enforce a trusted-command policy or strong isolation.
The vulnerability occurs in AgentScope v1.0.20 within the shell-command execution component at src/agentscope/tool/_coding/_shell.py. It becomes risky when an externally reachable agent, tool, workflow, or application entry can supply data that reaches execute_shell_command and the execution path does not enforce a trusted-command policy or strong isolation.
Exploit preconditions
- Attack surface: An application or agent entry that exposes the shell-command execution capability
- Required access: Ability to invoke the exposed entry or influence data processed by it
- Trigger point: Processing attacker-controlled input by
execute_shell_command - Why exploitation is possible: Untrusted data can reach a command or code execution boundary without sufficient restrictions on what may be executed
- Attack surface: An application or agent entry that exposes the shell-command execution capability
- Required access: Ability to invoke the exposed entry or influence data processed by it
- Trigger point: Processing attacker-controlled input by
execute_shell_command - Why exploitation is possible: Untrusted data can reach a command or code execution boundary without sufficient restrictions on what may be executed
Why this happens
The underlying issue is an unsafe trust boundary between externally influenced input and a function that executes shell commands. When command content or execution parameters are constructed from untrusted data without strict allowlisting, separation of arguments, and authorization checks, the data can be interpreted as executable instructions. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-controlled input may influence code or command execution.
The underlying issue is an unsafe trust boundary between externally influenced input and a function that executes shell commands. When command content or execution parameters are constructed from untrusted data without strict allowlisting, separation of arguments, and authorization checks, the data can be interpreted as executable instructions. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-controlled input may influence code or command execution.
Potential impact
- An attacker may execute arbitrary commands with the privileges of the AgentScope process
- The application environment could be compromised
- Sensitive files, credentials, or environment data could be accessed
- The vulnerability could enable data alteration, service disruption, or persistence
- Compromised hosts could be used for lateral movement when network permissions allow it
- An attacker may execute arbitrary commands with the privileges of the AgentScope process
- The application environment could be compromised
- Sensitive files, credentials, or environment data could be accessed
- The vulnerability could enable data alteration, service disruption, or persistence
- Compromised hosts could be used for lateral movement when network permissions allow it
General mitigation guidance
Mitigation generally focuses on removing unnecessary shell execution and reducing the amount of untrusted input that can reach execution boundaries.
Common defensive patterns include:
- Prefer fixed, non-shell APIs with structured argument handling over dynamically assembled shell commands
- Enforce explicit command and argument allowlists for any required execution capability
- Separate untrusted values from executable command structure and validate them against strict schemas
- Require authorization at the tool and workflow boundaries before execution
- Run execution tasks in isolated, least-privileged environments with restricted filesystem and network access
- Avoid exposing shell-capable tools to untrusted users or autonomous workflows unless the trust boundary is explicit
- Apply resource limits, auditing, and process isolation as defense-in-depth controls
Mitigation generally focuses on removing unnecessary shell execution and reducing the amount of untrusted input that can reach execution boundaries.
Common defensive patterns include:
- Prefer fixed, non-shell APIs with structured argument handling over dynamically assembled shell commands
- Enforce explicit command and argument allowlists for any required execution capability
- Separate untrusted values from executable command structure and validate them against strict schemas
- Require authorization at the tool and workflow boundaries before execution
- Run execution tasks in isolated, least-privileged environments with restricted filesystem and network access
- Avoid exposing shell-capable tools to untrusted users or autonomous workflows unless the trust boundary is explicit
- Apply resource limits, auditing, and process isolation as defense-in-depth controls
How teams detect issues like this
Detection can include static analysis and review rules for calls to execute_shell_command, subprocess APIs, shell invocation flags, dynamic command construction, and string interpolation near execution sinks. Code review should examine whether externally supplied agent messages, tool arguments, workflow data, or configuration values can reach these paths.
Runtime monitoring may flag unexpected child processes, commands outside an approved policy, unusual process ancestry, and shell activity from services that do not normally execute commands. CI and policy enforcement can require command allowlists, prohibit shell execution in untrusted request paths, and surface risky data flows through automated review tools.
Detection can include static analysis and review rules for calls to execute_shell_command, subprocess APIs, shell invocation flags, dynamic command construction, and string interpolation near execution sinks. Code review should examine whether externally supplied agent messages, tool arguments, workflow data, or configuration values can reach these paths.
Runtime monitoring may flag unexpected child processes, commands outside an approved policy, unusual process ancestry, and shell activity from services that do not normally execute commands. CI and policy enforcement can require command allowlists, prohibit shell execution in untrusted request paths, and surface risky data flows through automated review tools.
Sources
| Source | Link |
|---|---|
| gist. | gist.github.com/ |
| github. | github.com/ |
