Intelligence
Join the waitlist
AEV-2026-0026

AgentScope add_skill copies an unconfined source path into the agent workspace (CVE-2026-85685)

AgentScope's LocalWorkspace.add_skill confines the destination a copied skill writes into but applies no equivalent check to the source path a caller supplies, so any server side directory containing a minimally valid SKILL.md file can be copied into the agent's own workspace. Reported privately in June 2026, opened as a public GitHub issue in July, and formally assigned CVE-2026-85685 on 4 September 2026, with no maintainer response and no fix found in anything this record could establish.

AESS 8.0 highConfirmedStatus: publishedEvent: 12 June 2026Execution AuthorityEnvironment Boundaries

Affected

Organisation
AgentScope project
Product
AgentScope
Component
LocalWorkspace.add_skill, reached through the deprecated POST /workspace/skill endpoint
Versions
Through version 2.0.7.post1; no patched version found
Configurations
The AgentScope HTTP application layer's local filesystem workspace, with the deprecated add_skill endpoint reachable by a caller

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
A caller imports a skill directory into an agent's workspace through the add_skill endpoint
Agent
A caller of AgentScope's HTTP workspace API, identified only by a self declared X-User-ID header
Delegating actor
unknown
Action
Copied a caller named, unconfined server side directory into the agent's own skills folder
Target resource
Any server side directory the AgentScope process can read that contains a SKILL.md file with name and description frontmatter
Environment
The AgentScope server process and the local filesystem workspace it hosts
Credentials used
A caller supplied X-User-ID header value, checked only for being non empty
Privileges available
Whatever the AgentScope server process itself can read on its host filesystem
Authority presented
A well formed AddSkillRequest naming an agent id, a session id and a skill_path
Authority required
Authority over the specific source directory named by skill_path, not only over the destination the copy writes into
Applicable policy
The destination confinement check inside LocalWorkspace.add_skill; no equivalent policy governs the source
Approval mechanism
none
Required approver
unknown
Independent approval
no
Action binding
The destination confinement check was never paired with an equivalent check on the source the same call reads from
Sequence context
unknown

Impact

Consequence
Arbitrary server side directory contents copied into the agent's own workspace and made readable through its skill listing
Reach
organisational
Reversibility
unknown
Detectability
silent
Propagation
potential
Recovery
No patched version found. The GitHub issue's own proposed remediation, confining the source path with the same rigor as the destination and restricting sources to an approved root, has not been merged as of this record.

Evidence

Primary sources

Supporting sources

Reproduction status
Not exploited against a running deployment by Moona Intelligence. This session cloned agentscope-ai/agentscope directly at git tag v2.0.7.post1, the tag matching the CVE's own stated affected range and the repository's newest tag at the time of review, and read the vulnerable method, the request wiring and the identity dependency directly, confirming the mechanism the GitHub issue and the advisory each describe.
Evidence state
Confirmed

Known unknowns

  • Whether this has been exploited against a real AgentScope deployment.
  • What share of AgentScope deployments expose the HTTP workspace API this endpoint belongs to.
  • Whether AgentScope's maintainers have a fix in progress that has not yet been made public.

Limitations

  • This session's direct fetch of the official CVE Program record at cve.org was blocked by this session's own network egress policy; CVE metadata is corroborated through the GitHub Advisory Database rather than read directly from the Program's own record.
  • The GitHub issue itself was retrieved through this session's automated page fetch and summarization tool rather than read as raw markup, though its account is independently confirmed against this session's own direct read of the source at the affected tag.

Claim provenance

  • independent-reporting
    GitHub issue 2069, opened by a reporter independent of the AgentScope maintainers, and the GitHub Advisory Database's own record for GHSA-gpf9-4466-gc5g and CVE-2026-85685, both retrieved directly, state the same mechanism, the same affected version range and the same absence of a maintainer response or a merged fix.
    You Could Say Where a Skill Landed. Not Where It Came From.
  • verified
    This session cloned agentscope-ai/agentscope directly at the git tag matching the CVE's own affected range, v2.0.7.post1, and read the vulnerable method, the request wiring and the identity dependency directly rather than through a summarization pass, confirming the destination confinement check, the absent source check and the temporary X-User-ID identity mechanism exactly as described.
    You Could Say Where a Skill Landed. Not Where It Came From.