ModelScope AgentScope Code Injection Vulnerability (CVE-2026-6603)

Vulnerability Overview Vulnerability Name: modelscope agentscope up to 1.0.18 _python.py execute_python_code/execute_shell_command code injection Vulnerability ID: CVE-2026-6603 Vulnerability Type: Code Injection Severity: Critical CVSS Score: 6.6 Description: A code injection vulnerability was discovered in the file of . This vulnerability allows an attacker to execute arbitrary code by manipulating the or functions. Impact Scope Affected Versions: 1.0.0 to 1.0.18 Remediation Status: Unfixed Exploitation Status: Publicly available exploit code exists Attack Vector: Remote Attack Complexity: Low Authentication Requirement: None Impact Scope: Confidentiality, Integrity, Availability Remediation Plan Current Status: No specific remediation provided Recommended Measures: Replace affected components or use alternative products Additional Information CPE: - CPE 2.3: - CPE 2.2: CVSSv4: - Vector: - Base Score: 7.3 - Temporal Score: 6.6 CVSSv3: - Vector: - Base Score: 7.3 - Temporal Score: 6.6 CVSSv2: - Vector: - Base Score: 10.0 MITRE ATT&CK: T1059 Timeline: - 2026-04-19: Advisory published - 2026-04-19: Zero-day vulnerability database entry created - 2026-04-19: Zero-day vulnerability database entry last updated Sources: - Advisory: gist.github.com - CVE: CVE-2026-6603 - GCVE: CVE-2026-6603 - GCVE (VulDB): GCVE-108-350238 - scip Labs: https://www.scip.ch/en/?labs.20161013 Submission Information: - Submitter: Eric-f - Submission ID: 792223 Discussion: - No comments Summary This vulnerability is a critical code injection issue affecting multiple versions of . Currently, no specific fix has been provided; users are advised to take alternative measures as soon as possible to mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

ModelScope AgentScope Code Injection Vulnerability (CVE-2026-6603)