CVE-2026-85685 agentscope-ai CVE debrief

Who should care

Defenders responsible for AgentScope deployments should assess exposure and prioritize verification and mitigation. This includes verifying vulnerability presence, assessing potential exposure of sensitive directories, and prioritizing patching or mitigating vulnerable deployments. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to protect their systems.

Why it matters

CVE-2026-85685 is a high-severity path traversal vulnerability in AgentScope that allows attackers to copy arbitrary directories into the agent workspace. Defenders should verify vulnerability presence, assess exposure, and prioritize mitigation.

• Verify vulnerability presence in AgentScope deployments
• Assess potential exposure of sensitive directories
• Prioritize patching or mitigating vulnerable deployments
• Monitor for exploitation attempts

Technical summary

The vulnerability exists in the LocalWorkspace.add_skill function of AgentScope through 2.0.7.post1, allowing attackers to copy arbitrary server directories into the agent workspace via an unconfined source path parameter. This can be exploited by supplying any directory path in the skill_path request parameter. The vulnerability has a CVSS score of 8.7, indicating high severity. Defenders should prioritize verifying the vulnerability in their AgentScope deployments and applying the necessary patches or mitigations.

Defensive priority

Defenders should prioritize verifying the vulnerability in their AgentScope deployments and applying the necessary patches or mitigations.

Recommended defensive actions

• Verify AgentScope version and check for vulnerability
• Apply patches or mitigations provided by the vendor
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the exact scope of affected versions and potential exploitation remains limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.